I want to have a simple search box in my web application using Javascript/Node.js and Postgresql. In it I have a form which is open for the public to make searches for names. I am not using any ORM so how do I make this type of search query safe in the backend, while using .then() ?

I want to use sort of SELECT * FROM spotters WHERE last_name ilike '%Burns%' but safely. The code below doesn't work, but how can I solve this? It feels like it should be quite easy.

// req.query.name = 'Burns' --- Could be "';DROP TABLE"!
pg_client.query("SELECT * FROM spotters WHERE last_name ilike '%?%'", [req.query.name])
  .then((sqlResult) => {
// handle result
  })

I want to have code similar to the above where it can ilike-search for column last name with a query received from the search input.