I need to set my attributes in a SQL query according to variables. This has to be done in express / JS.

So I would need something like the Dollar values syntax (WHERE xyz = $1). But in my case xyz should be determined by the value of a variable.

I guess, just throwing this variable in a query-String is unsafe due to depency injection.

What would be the best/easiest way to do it? Sorry, if I am oversseing a simple fact, but I'm a beginner with JS / DB queries.