sql-tag.js

const mysql = require("mysql");
const { path, srcPath, host, user, password, database } = require("../config");

///

function exec(connection, query) {
  return new Promise((res, rej) => {
    connection.query(query, function(err, data) {
      if (err) {
        rej(err);
      }
      res(data);
    });
  });
}

function sql(strings, ...keys) {
  return function(...v) {
    var [connection, ...values] = v;
    var dict = values[values.length - 1] || {};
    var result = [strings[0]];
    keys.forEach(function(key, i) {
      var value = Number.isInteger(key) ? values[key] : dict[key];
      result.push(connection.escape(value), strings[i + 1]);
    });
    console.log(result.join(""));
    return exec(connection, result.join(""));
  };
}

///

const connection = mysql.createConnection({ host, user, password, database });

let findUser = sql`
  select firstName, lastName
  from user
  where firstName=${"firstName"} and lastName=${"lastName"}
`;

let me = {
  firstName: "Кирилл' -- ; DROP TABLE `blia`",
  lastName: "Яковенко`"
};

findUser(connection, me).then(r => console.log(r)).catch(e => console.log(e));