node.js - how to escape string but not affect LIKE result in nodejs mysql js -

recently using mysqljs in nodejs web app.
escape parameters in sql prevent injection attack.
in schema, sql affected escape string sign `

here query select event.name, host.name, guest.name         event event         left join host on host._id = event.host_id         left join event_guest on event_guest.event_id = event._id         left join guest on event_guest.guest_id = guest._id         host._id = event.host_id , event.status in ('on', 'off') ,          ( event.name "%?%" escape "'" or host.name "%?%" or guest.name "%?%")         limit ?, ?;     `, [cond, cond, cond, skip, limit]) 

if apply mysql.escape(cond)，the sql like "%'cond'%".
single quote affect result.

how can escaping params , keep origin sql ?

you add % start , end of string instead of in sql, may want escape original string too. also, if take @ https://github.com/mysqljs/mysql#escaping-query-values may notice don't need wrap values in double quotes (").

presuming trying achieve sql query this:

select event.name, host.name, guest.name event event left join host on host._id = event.host_id left join event_guest on event_guest.event_id = event._id left join guest on event_guest.guest_id = guest._id host._id = event.host_id , event.status in ('on', 'off') , (event.name '%search%' escape "'" or host.name '%search%', or guest.name '%search') limit 10, 0; 

this update code sample may work you:

new_cond = cond.slice(0, 1)+'%'+s.slice(1, cond.length-1)+'%'+cond.slice(cond.length-1); cond = mysql.escape(new_cond);  # should '%term%' status_in = ['on', 'off']; escape_char = "'"; connection.query('select event.name, host.name, guest.name     event event     left join host on host._id = event.host_id     left join event_guest on event_guest.event_id = event._id     left join guest on event_guest.guest_id = guest._id     host._id = event.host_id      , event.status in (?)     , ( event.name ? escape ?           or host.name ?            or guest.name ?     ) limit ?, ?;', [status_in, cond, escape_char, cond, cond, skip, limit])