我有一个在expressjs上运行的mysql数据库的简单api。

const express = require('express');
const router = express.Router();

const app = express();
const port = process.env.PORT || 5000;

app.listen(port, () => console.log(`Listening on port ${port}`));

var mysql = require('mysql')
var connection = mysql.createConnection({
  host: 'localhost',
  user: 'andri',
  password: '12345',
  database: 'andri'
});

app.get('/employees', function (req, res) {
  console.log(req);
  connection.query('select * from users', function (error, results, fields) {
    if (error) throw error;
    res.end(JSON.stringify(results));
  });
});

app.get('/employees/:id', function (req, res) {
  connection.query('select * from users where id=?', [req.params.id], function (error, results, fields) {
    if (error) throw error;
    res.end(JSON.stringify(results));
  });
});

app.post('/employees', function (req, res) {
  var postData = req.body;
  connection.query("INSERT INTO users (`id`, `userid`, `fullname`, `usergroup`, `emailid`, `mobile`, `title`, `created_at`) VALUES (NULL, '?', '?', '?', '?', '?', '?', CURRENT_TIMESTAMP);", 
  postData, function (error, results, fields) {
    if (error) throw error;
    res.end(JSON.stringify(results));
  });
});

我可以使用postman测试函数（employees/和employees/：id）的端点是否正常工作。但是post函数

{
    "userid": "PROJ-12345",
    "fullname": "Eko Andri S",
    "usergroup": "IT",
    "emailid": "eko.andri@xxx.or.id",
    "mobile": "0811111111",
    "title": "Intern",
    "created_at": "2018-05-30T01:59:17.000Z"
}

在波特斯曼身上得到这个结果：

{
    "fieldCount": 0,
    "affectedRows": 1,
    "insertId": 8,
    "serverStatus": 2,
    "warningCount": 0,
    "message": "",
    "protocol41": true,
    "changedRows": 0
}

以上记录在数据库中记录成功，但每个字段的值为“？”，没有引号；除了正确记录的时间戳。
如果我删除报价？在insert行中，我得到以下错误
您的sql语法有错误