SQL injection in Node.js's mysql package

We have released a rare example of SQL injection challenge that although the query is parametrised, it is still vulnerable to SQL injection.

This vulnerability exist in the mysql NPM package. The way it renders a value into SQL depends on the value’s type, and by default an object becomes a SQL fragment rather than a quoted string. So request data that arrives as an object where the code expected a string can change the query, even when the query uses ? placeholders.

On a login form, that can mean signing in without the right password.

Can you identify and fix the flaw?

Play it in the JavaScript game: Play - SecDim