Include SqlString from mysql and do not depend on the mysql package.

lib/SqlString.js

+var SqlString = exports;
+
+SqlString.escapeId = function (val, forbidQualified) {
+  if (forbidQualified) {
+    return '`' + val.replace(/`/g, '``') + '`';
+  }
+  return '`' + val.replace(/`/g, '``').replace(/\./g, '`.`') + '`';
+};
+
+SqlString.escape = function(val, stringifyObjects, timeZone) {
+  if (val === undefined || val === null) {
+    return 'NULL';
+  }
+
+  switch (typeof val) {
+    case 'boolean': return (val) ? 'true' : 'false';
+    case 'number': return val+'';
+  }
+
+  if (val instanceof Date) {
+    val = SqlString.dateToString(val, timeZone || "Z");
+  }
+
+  if (Buffer.isBuffer(val)) {
+    return SqlString.bufferToString(val);
+  }
+
+  if (Array.isArray(val)) {
+    return SqlString.arrayToList(val, timeZone);
+  }
+
+  if (typeof val === 'object') {
+    if (stringifyObjects) {
+      val = val.toString();
+    } else {
+      return SqlString.objectToValues(val, timeZone);
+    }
+  }
+
+  val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {
+    switch(s) {
+      case "\0": return "\\0";
+      case "\n": return "\\n";
+      case "\r": return "\\r";
+      case "\b": return "\\b";
+      case "\t": return "\\t";
+      case "\x1a": return "\\Z";
+      default: return "\\"+s;
+    }
+  });
+  return "'"+val+"'";
+};
+
+SqlString.arrayToList = function(array, timeZone) {
+  return array.map(function(v) {
+    if (Array.isArray(v)) return '(' + SqlString.arrayToList(v) + ')';
+    return SqlString.escape(v, true, timeZone);
+  }).join(', ');
+};
+
+SqlString.format = function(sql, values, timeZone) {
+  values = [].concat(values);
+
+  return sql.replace(/\?/g, function(match) {
+    if (!values.length) {
+      return match;
+    }
+
+    return SqlString.escape(values.shift(), false, timeZone);
+  });
+};
+
+SqlString.dateToString = function(date, timeZone) {
+  var dt = new Date(date);
+
+  if (timeZone != 'local') {
+    var tz = convertTimezone(timeZone);
+
+    dt.setTime(dt.getTime() + (dt.getTimezoneOffset() * 60000));
+    if (tz !== false) {
+      dt.setTime(dt.getTime() + (tz * 60000));
+    }
+  }
+
+  var year   = dt.getFullYear();
+  var month  = zeroPad(dt.getMonth() + 1);
+  var day    = zeroPad(dt.getDate());
+  var hour   = zeroPad(dt.getHours());
+  var minute = zeroPad(dt.getMinutes());
+  var second = zeroPad(dt.getSeconds());
+
+  return year + '-' + month + '-' + day + ' ' + hour + ':' + minute + ':' + second;
+};
+
+SqlString.bufferToString = function(buffer) {
+  var hex = '';
+  try {
+    hex = buffer.toString('hex');
+  } catch (err) {
+    // node v0.4.x does not support hex / throws unknown encoding error
+    for (var i = 0; i < buffer.length; i++) {
+      var byte = buffer[i];
+      hex += zeroPad(byte.toString(16));
+    }
+  }
+
+  return "X'" + hex+ "'";
+};
+
+SqlString.objectToValues = function(object, timeZone) {
+  var values = [];
+  for (var key in object) {
+    var value = object[key];
+    if(typeof value === 'function') {
+      continue;
+    }
+
+    values.push(this.escapeId(key) + ' = ' + SqlString.escape(value, true, timeZone));
+  }
+
+  return values.join(', ');
+};
+
+function zeroPad(number) {
+  return (number < 10) ? '0' + number : number;
+}
+
+function convertTimezone(tz) {
+  if (tz == "Z") return 0;
+
+  var m = tz.match(/([\+\-\s])(\d\d):?(\d\d)?/);
+  if (m) {
+    return (m[1] == '-' ? -1 : 1) * (parseInt(m[2], 10) + ((m[3] ? parseInt(m[3], 10) : 0) / 60)) * 60;
+  }
+  return false;
+}

lib/utils.js

-var mysql      = require("mysql")
-  , connection = mysql.createConnection({})
-  , util       = require("util")
+var util       = require("util")
   , DataTypes  = require("./data-types")
+  , SqlString  = require("./SqlString")
 
 var Utils = module.exports = {
   _: (function() {
@@ -44,10 +43,10 @@ var Utils = module.exports = {
     return s.replace(new RegExp(Utils.TICK_CHAR, 'g'), "")
   },
   escape: function(s) {
-    return connection.escape(s).replace(/\\"/g, '"')
+    return SqlString.escape(s, true, "local").replace(/\\"/g, '"')
   },
   format: function(arr) {
-    return connection.format.apply(connection, [arr.shift(), arr])
+    return SqlString.format(arr.shift(), arr)
   },
   isHash: function(obj) {
     return Utils._.isObject(obj) && !Array.isArray(obj);

package.json

@@ -22,7 +22,6 @@
     }
   ],
   "dependencies": {
-    "mysql": "~2.0.0-alpha3",
     "underscore": "~1.4.0",
     "underscore.string": "~2.3.0",
     "lingo": "~0.0.5",