String parameters and escape() are escaped before encoding under big5, gbk, sjis and cp932

For a string parameter of a text-protocol query, the connector has to insert a backslash before quotes and backslashes, then send the string in the session character set.

Today it does this in two steps, in that order: writeDefaultStringEscapeQuote() (query parameters) and Utils.escape() (conn.escape()) walk the JavaScript string, insert the backslash between characters, and the result is then encoded with iconv-lite.
This works if every character encodes to bytes the server reads as one character: the inserted backslash then always sits between two characters.

That assumption does not hold, because iconv-lite's tables are not the server's. iconv-lite's big5 is Big5-HKSCS, a superset of the server's big5. For instance U+56ED (園, "garden") encodes to FB 5C; the server does not accept FB as a big5 lead byte, so it reads FB alone and 5C as a backslash. The value 園' is therefore sent as FB 5C 5C 27: the server reads FB, then 5C 5C as an escaped backslash, then 27 as a bare quote that ends the literal. The rest of the value is parsed as SQL.

thanks to fg0x0 for report