I am trying to execute a mysql query in express js application

    function(req,res){
           var params = [req.body.category,1]
           db.query("SELECT * FROM TABLE WHERE category IN ? AND status=?",[params],function(error,result){
           console.log(error);
  })
      

Here is the input value of req.body.category : ["pen","book"]

UPDATE

Based on comments i've changed my query and the input

 final query "SELECT * FROM TABLE WHERE category IN ("+req.body.category+")"
 

input:"'f','test'"

However this works fine but query still vulnerable to sql injection attack so i enclosed it with db.escape(req.body.category) but it returns empty result