SQL database query wrapper

Question

How can I write a better database query wrapper?

//code for connection 
exports.connect = function(callback) {
 client.connect(function(err, conInfo){
 if (err) callback(err);
 conInfo = "Connection at " + client.host + ":" + client.port + "/"
 + client.database + " used by " + client.user;
 callback(null, conInfo);
 });
};
//for queries that do not return realation
exports.runQuery = function(query_str, columns, params, callback) {
 var sqlQuery = query_str + " " + columns;
 client.query(sqlQuery, params, function(err) {
 console.log("NEW QUERY____________________");
 console.log(sqlQuery);
 console.log(params);
 if (err) throw err;
 callback(null);
 });
};
//for select queries
exports.executeQuery = function(query_str, callback) {
 var query = client.query(query_str, function(err){
 console.log("NEW QUERY____________________");
 console.log(query_str);
 if (err) throw err;
 query.on("row", function(row, result) {
 result.addRow(row);
 });
 query.on("end", function (result) {
 callback(null, result.rows);
 });
 });
};

Answer 1

I don't do JS, even less node.js, but from the looks of it you seem to be taking in a string for your query, which means client code can do something like "select x, y, sum(z) from mytable where x = " + someValue + " group by x, y" - which is prone to SQL-injection: your client code needs to remember that.

If your executeQuery also took parameters, I think it would be clearer that when you need parameters, they should be passed as arguments to that function, not concatenated into the query string.