Avoiding SQL Injection with Parameterized Queries

const userId = "1'; DROP TABLE users; --"  
yield* sql`SELECT * FROM users WHERE id = ${userId}`