This article is just "string concatenation bad, automatic machinery for URL encoding good", just with the extra zest of blaming template literals (the true name

This article is just "string concatenation bad, automatic machinery for URL encoding good", just with the extra zest of blaming template literals (the true name for "backtick strings"). This is something we learned 30 years ago with SQL injection. In reality, template literals aren't the problem. In fact, it'd be trivial to write a tagged template literal function that auto-encoded all parameters you passed to it anyway - I'm sure one already exists in package form somewhere. This is a red herring. Template literals aren't your issue.