rename db to sql
use pool.query and handle errors