From the mysqljs readme: "Caution This also differs from prepared statements in that all ? are replaced, even those contained in comments and strings."

Eek. "select * from classes where teacher = '?'" -> boom.