Using quotes in query ignores parameters inside the quotes about node-pg-pool HOT 3 CLOSED

Parameters are a PostgreSQL concept, not just a pg invention. They’re expressions and don’t work by simple string replacement. This is consistent with how you would select a string:

pool.query(`SELECT $1`, ['example'])

and not

pool.query(`SELECT '$1'`, ['example'])

One safe correction to your example (${longitude} ${latitude} is unsafe by default and could lead to SQL injection):

const query =
  `
  SELECT statefp, name, stusps
  FROM my_table as tb
  WHERE st_contains(tb.geom, st_geomfromtext('POINT(' || $1 || ' ' || $2 || ')', 4269))
  `
const states = await client.query(
 query,
 [ longitude, latitude ]
)

from node-pg-pool.

Rather than serializing and bind the geo types as text, you can directly create a point via: POINT(x,y)

from node-pg-pool.

@charmander @sehrope Thanks for the explanation - this makes a lot more sense now.

Closing this issue :-)

from node-pg-pool.