Wait, is the SQL example vulnerable?

Oh, tagged template literals

No, the template string decompiles to query('SELECT * FROM users WHERE id=$1', [id])