Hey @porsager, I checked the difference between both approaches and wanted to confirm if we still get protection from SQL injection if we pass values as parameters in unsafe calls. e.g.

await sql.unsafe('select * from nudge.user where id = $1', ["307edd8e-1179-4f51-90f8-7cd58ce50719'--"]),

I checked same call with recommended templating way, but that also didn't threw any error for this particular SQL injection example

const where = "307edd8e-1179-4f51-90f8-7cd58ce50719'--";
await sql`select * from nudge.user where id = ${where}`,