Prevent SQL Injection in Javascript/Node

I am using Node.js to create a Discord bot. Some of my code looks as follows:

var info = {
  userid: message.author.id
}

connection.query("SELECT * FROM table WHERE userid = '" + message.author.id + "'", info, function(error) {
  if (error) throw error;
});

People have said that the way I put in message.author.id is not a secure, way. How can I do this? An example?

via Rusty