"No, you can't be trusted to have a .quote(...) method, just use parameterized queries where you pass in the SQL as text in an object and the actual value in an array, and we'll opaquely drop your update with a {..."status":"UPDATE 0"} response" <-- statements dreamed up by the utterly deranged.