Sequelize: escape string in a literal string

I can use literal in Sequelize to manually build a SQL query part:

sequelize.literal(`"foo".bar ILIKE '%baz%'`)

But if I want to add a var in this literal block, I now introduce SQL injection vulnerability:

sequelize.literal(`"foo".name ILIKE '%${myVar}%'`)

Is there a Sequelize way to protect variables in literal blocks?

Solution

You could use escape:

const escapedSearch = sequelize.escape(`%${myVar}%`);
sequelize.literal(`"foo".name ILIKE ${escapedSearch}`);