Consider the following code :

const res = "SELECT name, lastname, age FROM users WHERE name = '" + name + "' ORDER BY name ASC

Assuming that name is populated by the user, though a form, or a url parameter, or whatever, what happens if instead of inserting a name, i insert the following ?

john; DELETE FROM users; --

Your SQL statement becomes :

SELECT name, lastname, age FROM users WHERE name = 'john'; DELETE FROM users; -- ORDER BY name ASC

I have successfully inserted a second sql query in your codebase and you've just lost all of your users.

Well, this is the basics of SQL injections. You defend against them by making sure that you verify the parameters passed to your queries. There are helpers designed to do this and most ORMs handle this automatically (which is part of why we usually recommend using ORMs)