title: Node-MySQL - Escaping in Query() Method vs Mysql.Escape() / Mysql.EscapeId()
body: <p>I am currently using the <a href="https://github.com/felixge/node-mysql" rel="noreferrer">node-mysql</a> library to connect my application to a MySQL instance.  After reading some other StackOverflow questions and articles I found, it sounds like node-mysql automatically escapes unsafe characters every time the <code>query()</code> method is called.  But on some code snippets, I also see <code>mysql.escape()</code> and <code>mysql.escapeId()</code> being called within the <code>query()</code> method.</p>
  
  <p>It seems like that while <code>query()</code> automatically escapes some dangerous characters, you should still call <code>mysql.escape()</code> and <code>mysql.escapeId()</code> to escape other dangerous characters.  </p>
  
  <p>Is this correct?  If so, what kind of SQL injection attacks are automatically protected against by the <code>query()</code> method and what kind of SQL injection attacks are protected by calling <code>mysql.escape()</code> and <code>mysql.escapeId()</code>?</p>