How can one escape dates in ExpressJS to MySQL without messing up the format of the date?

I have an API written in express. I am trying to add a simple endpoint with a pretty straightforward query that runs correctly in the MySQL terminal. However, when I pass the query my parameters (start and end dates), the query doesn't work when I send a GET request using Postman. This is where my query is in my API:

var db = require('../../dbconnection');
var PORegister = {
  getPORegister:function(start,end,callback) {
    return db.query("SELECT * FROM purchase_orders WHERE PODate BETWEEN '?' AND '?' ORDER BY PODate DESC",[start,end],callback);
  }
}
module.exports = PORegister;

And here is my routing in Express:

var express = require('express');
var router = express.Router();
var PORegister = require('../../models/reports/PORegister');

router.get('/:start/:end',(req,res,next) => {
  PORegister.getPORegister(req.params.start,req.params.end,(err,rows) => {
    if (err) res.json(err);
    else res.json(rows);
  })
})
module.exports = router;

I have console logged in the routing file and I know that my req.params are coming in formatted as I wish, (YYYY-MM-DD), this is the format which has worked in MySQL for me. Something is going wrong when I pass these parameters into the query and I do not understand what it is.

via Colin Harrison