Until you accidentally leave out that `sql` tag. Or will that now generate an error?
Re:SQL Injection in Node.js
by ForbesLindesay on Tuesday July 30, 2019 @01:15PM
(#20566903)
Yes, as it says in the article. The tag returns a class that's an instance of SQLQuery. All the @databases clients only accept SQLQuery instances and don't accept strings. This means you get a runtime error if you're using JavaScript, and a type error at build time if you're using TypeScript.
By providing an API that makes it virtually impossible to create an SQL Injection vulnerability, we can allow novices to write code safely. Once you know what the `sql` tag is doing, it's really easy to review the code and be confident it isn't vulnerable.