SELECT NOT IN syntax error?

Question

PostgreSQL

I am using pg-promise for nodejs .
It is necessary to make a selection according to the NOT IN condition. In the example, the parameter that comes in is an array.
https://github.com/vitaly-t/pg-promise/wiki/Learn-...
I have this view object

let obj = {
    limit: limit,
    list: list // массив здесь
  };

The request itself:

return db.query(`
            SELECT *
            FROM table WHERE 
            id NOT IN (${obj.list}:csv)
            LIMIT ${obj.limit}
        `);

An error is thrown

{ error: ошибка синтаксиса (примерное положение: ":")

1. What am I doing wrong?
2. How to correctly substitute parameters in the request so that all potentially dangerous characters are escaped? Am I correct or not?

Answer 1

What am I doing wrong?

Trying to substitute values ​​using template strings instead of using the formatting tools that pg-promise provides (or rather, mixing these approaches).
Yes, something like this, for example:

db.query(`
  SELECT *
  FROM table
  WHERE id NOT IN ($(list:csv))
  LIMIT $(limit)
`, obj)