How to deal with commas when conditionally forming queries

I'm fairly new to creating APIs with ExpressJS, and I came across this problem when forming a query based on the request:

UPDATE user
SET ${username ? `username = '${username}', ` : ``}${
      password ? `password = '${password}'` : ``
    }${isStaff ? `isStaff = '${isStaff}'` : ``
    } WHERE email = '${email}'

Here, I have a comma after username and password, but there is no guarantee that the request would update all three columns. For example, if the request body only has username, then I'd end up with this query with a syntax issue:

UPDATE user 
SET username = 'exampleuser',

How can I dynamically set the commas in this conditionally determined query so that the commas would only appear between the columns I'm setting?

Thanks a lot in advance!

I've tried setting a condition for every column in each column block, but that was obviously extremely ugly.

Don't use string concatenating parameters, it will lead to SQL Injection attack

Instead, you should use Parameterized Query

All famous ORM, node native database drivers, and query builders provide this feature.

For example:

• Parameterized Query of node-postgres.

• Raw query of knex.js provide Raw Parameter Binding feature.

> Sometimes you may need to use a raw expression in a query. Raw query object may be injected pretty much anywhere you want, and using proper bindings can ensure your values are escaped properly, preventing SQL-injection attacks.

Put commas after all variable columns and add a trailing no-op update to be a last-column anchor:

UPDATE user SET
  ${username ? `username = '${username}', ` : ``}
  ${password ? `password = '${password}', ` : ``}
  ${isStaff ? `isStaff = '${isStaff}', ` : ``}
  email = email
WHERE email = '${email}'

The final query will create valid SQL even if no variable columns are provided. For example, with the first 2 columns specified:

UPDATE user SET
  username = 'foo',
  password = 'mypass',
  email = email
WHERE email = 'myuser@mydomain.com'

or with none provided:

UPDATE user SET
  email = email
WHERE email = 'myuser@mydomain.com'

Updating a column to itself causes no problems.

Not related to your problem or this solution, you shouldn't be putting text from the user straight into your SQL due to possible SQL Injection attacks. Use a secure library to create a prepared statement that you provide the parameters for.