I'm not entirely sure on expressJS, but I'm pretty sure setting a cookie for every parameter in that object is extremely bad security practice as you are literally setting them all as plain text cookies stored in the users browser. Use the session class. Please.
Alternatively instead of...
Upon extensive and careful review of this thread I have come to the conclusion that LeChris totally scammed Each for fucking 10 bucks. LMFAO. Sorry this happened to you man.
Even if it's not important to the code, it's not worth simplifying things in a way which is literally wrong. If you are gonna explain how something works please do it right.
This is incorrect. It isn't because prepared statements cast values to single quote strings. It's because mysql literally just doesn't support it. When you are using prepared statements, the statement and variables are sent separately.