Am I connecting and querying the database correctly?

Question

Node.js

I'm learning node and trying to make a pet project with rest api. Am I doing it right or are there mistakes? Should I close connections or not?
db.js

const mysql = require('mysql2');

const pool = mysql.createPool({
  host: 'XXX',
  user: 'XXX',
  password: 'XXX',
  database: 'XXX',
  waitForConnections: true,
  connectionLimit: 10,
  queueLimit: 0,
  charset : 'UTF8MB4_UNICODE_CI',
  multipleStatements: true
});

export {pool}

api.js

import {pool} from "db";
const promisePool = pool.promise()
const express = require('express');
const app = express();

app.get('/api', async function (req, res) {

  const sql = `SELECT * FROM ........`

  try{
    const[rows] = await promisePool.query(sql)
    res.json(rows)
  }
  catch (e) {
    console.log(e)
  }

});

Answer 1

I'm not an expert, but it seems like a bad idea as it creates a sql injection vulnerability const sql = `SELECT * FROM ........`