I don't know that db node but I doubt the format is correct. (I.e you've written js like syntax but I highly doubt it will evaluate the string concatenation with msg.payload)
Try putting a function node before the SQL node and build the SQL and pass it in.
Alternatively - perhaps that node mentions mustache format in its help info?