Excerpt from a service that constructs a complex SQL-GIS query

ShopService.js

/*
 * Whenever possible try and construct all the queries by using the ORM API.
 * Manually written queries are susceptible to SQL-injections
 */
_getClosestQuery(params) {
    const seq = this.Model.sequelize;
    const point = seq.fn('ST_MakePoint', ...params.point.coordinates);
    const srid = seq.fn('ST_SetSRID', point, 4326);
    const stDistanceSphere = seq.fn('ST_DISTANCE_SPHERE', seq.col('point'), srid);

    const query = {
        attributes: {
            include: [[stDistanceSphere, 'distance']]
        },
        include: [{model: this.server.plugins.users.User.scope('canReceiveOffers'), required: true}],
        order: [[stDistanceSphere, 'ASC']],
    };

    if (params.limit) {
        query.limit = params.limit;
    }

    if (_.isObject(params.where)) {
        query.where = _.assign(query.where, params.where);
    }

    return query;
}