var table = 'baz';

const foo = "SELECT foo FROM " + table;
const select = `SELECT foo FROM ${table}`;
var del = `DELETE FROM ${table} WHERE condition;`;
let update = ' UPDATE ' +
             table +
             "SET column1 = value1, column2 = value2" +
             "WHERE condition;";

// Not safe: template strings with value
let update = ` UPDATE ` +
             'mytable' +
             `SET column1 = value1, column2 = ${value}` +
             "WHERE condition;";

// Safe: using parameterized queries
const query = "SELECT foo FROM users WHERE id = ?";
connection.query(query, [userId]);

// Safe: only strings
let update = ' UPDATE ' +
             'mytable' +
             "SET column1 = value1, column2 = value2" +
             "WHERE condition;";

// safe: template strings without value
let update = ` UPDATE ` +
             'mytable' +
             `SET column1 = value1, column2 = value2` +
             "WHERE condition;";