Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

196
Views
postgres variable injection vs js template string

I am trying to make query returning fields a bit more flexible by passing in the column to be returned but if I use variable injection it will not work and if I use template string it'll work fine.

I am trying not to use template string as possible for these injections

  const select = ["_id", "status"]
  const selectFields = select.map(field => `"${field}"`).join(',');

  // using variable injection, the querying will try to query `'"_id","status"'`
  // which doesn't work
  const theRow = await db.oneOrNone(
    `SELECT $1
     FROM "TableName"`,
    [selectFields]
  );


  // if I use template string, it'll work properly
  const theRow = await db.oneOrNone(
    `SELECT ${selectFields}}
     FROM "TableName"`
  );

How can I make the query to query properly even with variable injection? Thanks in advance for any help / suggestions

about 4 years ago · Juan Pablo Isaza
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!