转义啊。

    // refer to https://github.com/XadillaX/Toshihiko/blob/develop/lib/escaper.js#L17
    return str./**escapeRegExp().*/chars().reduce(function(str, ch) {
        switch(ch) {
            case "\n"   : str += "\\n"; break;
            case "'"    : str += "\\'"; break;
            case "\""   : str += "\\\""; break;
            case "\t"   : str += "\\t"; break;
            case "\0"   : str += "\\0"; break;
            case "\r"   : str += "\\r"; break;
            case "\b"   : str += "\\b"; break;
            case "\x1a" : str += "\\Z"; break;
            case "\\"   : str += "\\\\"; break;

            default: str += ch; break;
        }
        return str;
    }, "");

类似于这样子的。

https://github.com/XadillaX/Toshihiko/blob/develop/lib/escaper.js#L17

这不是node的问题。

https://github.com/felixge/node-mysql/blob/master/lib/protocol/SqlString.js#L16

@jysperm 预防SQL注入，可使用node-mysql的?占位符，内部替换时候使用了connection.escape