var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;';

http://example.net/foo?id=1;INSERT INTO y VALUES (things...);--