node-postgres prepared statement - sql injection

I am new to node-postgres and am unable to resolve this error when I try to ensure no sql injection is possible with my prepared statement.

Here is a snippet of the code

// the prepared statement 
var preparedstatement = client.query({
                  text: "select ST_AsText(ST_Transform(geodata,4326)) from table_name where ST_Contains(ST_GeomFromText($1,4326),table_name.geodata)",
                  values: ["POINT(Lat Long)"],
                  name: 'where'
                });

// the query 
var queryresult = client.query({name: 'where', values: [msg]},["'; DROP TABLE user;"], function(err) {
          if (err) {
                socket.emit('query error', String(err));
            }
        });

Whenever I enter the geodata (as a message from the client using socket.io), the socket.emit returns an error saying 'Invalid geometry'. However the code works fine when I remove ["'; DROP TABLE user;"], from the code i.e.

// the query 
var queryresult = client.query({name: 'where', values: [msg]}, function(err) {
          if (err) {
                socket.emit('query error', String(err));
            }
        });

(above) works perfectly. Any help in helping me understand what I am doing wrong here would be great.

Thanks for your time and support :)