Use parameterized queries

[ianshward]

To avoid any possibilities of SQL injection, parameterized queries should be used.

• https://github.com/brianc/node-postgres/wiki/FAQ#8-does-node-postgres-handle-sql-injection
• Example https://github.com/brianc/node-postgres/wiki/Client#method-query-parameterized

This should be used anywhere where you're using a variable in a query statement, for example:

• https://github.com/mapbox/report-dt/blob/dev/load.js#L111
• https://github.com/mapbox/report-dt/blob/dev/load.js#L118
• https://github.com/mapbox/report-dt/blob/dev/load.js#L120
• https://github.com/mapbox/report-dt/blob/dev/server.js#L40
• https://github.com/mapbox/report-dt/blob/dev/server.js#L51
• https://github.com/mapbox/report-dt/blob/dev/server.js#L61
• Where else?

[Rub21]

@ianshward this task is done: https://github.com/mapbox/report-dt/blob/dev/load.js#L69-L70

https://github.com/mapbox/report-dt/blob/dev/load.js#L119-L123

https://github.com/mapbox/report-dt/blob/dev/server.js#L39-L41

And others lines where I use sql code.

[Rub21]

done, close here.