[Elfix]

Нашел решение через squel

const validKeys = ['firstName', 'lastName', 'patronymic', 'birthday', 'gender', 'email'];

    let orderBy = request.query.orderBy;
    let filters = request.query.filters;

    Object.keys(orderBy).forEach((key) => validKeys.includes(key) || delete orderBy[key]);
    orderBy = snakecaseKeys(orderBy);

    Object.keys(filters).forEach((key) => validKeys.includes(key) || delete filters[key]);
    filters = snakecaseKeys(filters);

    let query = squel.select()
        .field('id')
        .field('display_name')
        .from('people');

    Object.keys(filters).forEach((key) => {
        query = query.where(`${key.toString()} = '${filters[key]}'`);
    });

    Object.keys(orderBy).forEach((key) => {
        query = query.order(key.toString(), orderBy[key].toLowerCase() === 'asc');
    });

    query = query.toParam();

    console.log(query.text);

Насколько хорошо это с точки зрения SQL-инъекций?