SQL Tag

Alternatively to sql.query() also the client.query() of pg can be used. The downside is the missing check the given parameter is a SQL tagged template literal. A missing SQL tag can open the doors for SQL injection.

Extract and bind values

const email = 'email'
const name = 'name'

const result = await sql.query(sql`
  SELECT * FROM users WHERE email = ${email} AND name = ${name}
`)

// text: SELECT * FROM users WHERE email = $1 AND name = $2
// values: ['email', 'name']