diff --git a/lib/protocol/SqlString.js b/lib/protocol/SqlString.js
index <HASH>..<HASH> 100644
--- a/lib/protocol/SqlString.js
+++ b/lib/protocol/SqlString.js
@@ -53,11 +53,13 @@ function zeroPad(number) {
 SqlString.format = function(sql, values) {
   values = [].concat(values);
 
-  values.forEach(function(value) {
-    sql = sql.replace('?', SqlString.escape(value));
-  });
+  return sql.replace(/\?/g, function(match) {
+    if (!values.length) {
+      return match;
+    }
 
-  return sql;
+    return SqlString.escape(values.shift());
+  });
 };
 
 SqlString.dateToString = function(date) {
Fix: '?' value handling in SqlString.format

The new approach caused '?' values to be considered targets for
replacement as well as the replace operation was no longer atomic.

Fixed as suggested by @aschmitz

Fixes #<I>