what are the different ways to specify the values in PostgreSQL? I have a question regarding the value initialization 


In query tool:

Insert into tablename(field1, field2, field3..) 
values (value1, value2, value3..);

In my JavaScript code, I am using: 

db.query({ text: 'INSERT INTO tablename(field1, field2, field3) 
    VALUES ($1, $2, $3)', values: [value 1 , value 2 , value 3'] }).then(...)

is this a good practice?

select * from tablename where _id="+[value]+" AND field1 = "+[value]+";



I have listed 3 query above. As per my knowledge 1 &amp; 2 are right as I tried them in many of my projects. Can someone clarify is the option 3 is also a correct method? Does it match the standards?
If the values are obtained from a user input, 2) and 3) are a bad idea. 

You shouldn't put user supplied values directly into the SQL string, but use a prepared statement with bind variables. Not doing that, makes your application vulnerable to SQL Injection

How you use a prepared statement with bind variables depends on the programming language you are using.