SQL injection , something to check !

[tawfiknasser]

GeekWars/database/queries/queries.js

Lines 3 to 12 in ec2ffab

	const userExist = (username, cb) => query.select(`SELECT count(id) from users where username = '${username}'`, cb)
	const checkPassword = (username, password, cb) => query.select(`SELECT count(id) from users where username = '${username}' AND password = '${password}'`, cb)
	const addUser = (username,password,email,cb) => query.insert(`INSERT INTO users (username,password,email) VALUES ($1,$2,$3)`,[username,password,email],cb)
	const getQuestions = (cb) => query.select(`SELECT * from qa`,cb)
	const getPass = (username,cb) => query.select(`SELECT password from users where username = '${username}'`,cb);
	const getScore = (username,cb) => query.select(`SELECT score from users where username='${username}'`,cb);

what if i insert username =
"tamer"; DROP TABLE users;

send the argument in SELECT queries exactly how you do it with the insert