How to prevent SQL Injection in Node.js Express applications?

I'm building a REST API with Express.js and PostgreSQL. I'm using raw SQL queries with `pg` driver. What are the best practices to prevent SQL injection attacks? Here's my current code: ```javascript app.get('/users', async (req, res) => { const { name } = req.query; const result = await pool.query(`SELECT * FROM users WHERE name = '${name}'`); res.json(result.rows); }); ``` I know this is vulnerable, but what's the proper way to fix it?