node-mysql question: db.escape, does it wrap quotes around strings?