title: I am trying to use prepared statements to insert values given in an array
body: <p>I am trying to INSERT values given in an array into my table, where each element of the array is a column in the table. Keep in mind this is for an API so the data is received through requests.
  Here's the concerned parts in my code:
  user.model.js:</p>
  <pre><code>User.create = function (newUser, result) {
  console.log(Object.values(newUser));
  dbConn.query(&quot;INSERT INTO user(user_fname, user_name, user_email, user_phone, user_is_admin) set ?&quot;, Object.values(newUser), function (err, res) {
      if (err) {
          console.log(&quot;error: &quot;, err);
          result(err, null);
      } else {
          console.log(res.insertId);
          result(null, res.insertId);
      }
  });};
  </code></pre>
  <p>user.controller.js:</p>
  <pre><code>exports.create = function (req, res) {
  const new_user = new User(req.body);
  console.log(req.body);
  
  if (req.body.constructor === Object &amp;&amp; Object.keys(req.body).length === 0) {
      res.status(400).send({
          error: true,
          message: 'Please provide all required field'
      });
  } else {
      console.log(new_user);
      User.create(new_user, function (err, user) {
          if (err) {
              res.send(err);
          }
          res.json({
              error: false,
              message: &quot;User added successfully!&quot;,
              data: user
          });
      });
  }};
  </code></pre>
  <p>In this last bit of code here is the output of the console.logs:</p>
  <pre><code>{
    user_fname: 'toto',
    user_name: 'titi',
    user_email: 'who@where.how',
    user_phone: '1010101010',
    user_is_admin: 'false'
  }
  User {
    fname: 'toto',
    name: 'titi',
    email: 'who@where.how',
    phone: '1010101010',
    is_admin: 'false'
  }
  [ 'toto', 'titi', 'who@where.how', '1010101010', 'false' ]
  </code></pre>
  <p>And last but not least here's the error message I get:</p>
  <blockquote>
  <p>error:  SqlError: (conn=357, no: 1064, SQLState: 42000) You have an
  error in your SQL syntax; check the manual that corresponds to your
  MariaDB server version for the right syntax to use near 'set 'toto''
  at line 1 sql: INSERT INTO user(user_fname, user_name, user_email,
  user_phone, user_is_admin) set ? -
  parameters:['toto','titi','who@where.how','1010101010','false']</p>
  </blockquote>
  <p>I'm clear on the fact my syntax is wrong but I can't seem to find anything that works. Thank you for your time :)</p>