postgres.js sanitizes inputs, but also provides a backdoor, so

  sql`select ${"hello"}, ${sql`world`}`

becomes

  select $1, world

[1] https://github.com/porsager/postgres