title: Node Mysql Escaping - Mysql.Escape() / Mysql.EscapeId()
body: <p>I am using mysql-node: <a href="https://github.com/mysqljs/mysql" rel="nofollow noreferrer">https://github.com/mysqljs/mysql</a> but I am a little confused about default sanitization, <code>Mysql.Escape()</code> vs <code>Mysql.EscapeId()</code> and the use of <code>?</code> vs <code>??</code>. The docs says? </p>
  
  <p><strong>Default Sanitization</strong></p>
  
  <blockquote>
    <p>When you pass an Object to .escape() or .query(), .escapeId() is used
    to avoid SQL injection in object keys.</p>
  </blockquote>
  
  <p>I see the term Object, so does that mean I should still escape queries like this?</p>
  
  <p><code>UPDATE table SET  updated_at = userInput WHERE name = userInput</code>. </p>
  
  <p><strong>Mysql.Escape() vs Mysql.EscapeId()</strong> <br/>
  What is the difference between these two functions. The docs says mysql.escape uses mysql.escapeId. I know they both sanitize input but is there a case where you use one or the other? </p>
  
  <p><strong>? vs ??</strong> <br/>
  The docs use <code>?</code> and <code>??</code> interchangeably. Do they mean the same thing? </p>