From the mysqljs readme: "Caution This also differs from prepared statements in that all ? are replaced, even those contained in comments and strings." Eek. "s

From the mysqljs readme: "Caution This also differs from prepared statements in that all ? are replaced, even those contained in comments and strings." Eek. "select * from classes where teacher = '?'" -> boom.