SQL String Escape
Escape text for use inside a single-quoted SQL string: double the quotes (standard SQL) or use MySQL backslash escapes. Optional wrapping in quotes.
Every ' becomes ''. Works in PostgreSQL, SQLite, SQL Server, Oracle and MySQL with NO_BACKSLASH_ESCAPES. In application code, prefer parameterized queries.
Runs entirely in your browser. Your data is never uploaded.
Related Tools
View AllWhat is SQL String Escape?
SQL Escape converts a raw text value into a form that can be placed inside a single-quoted SQL string literal. Standard mode doubles every single quote (O'Reilly → O''Reilly); MySQL mode uses backslash escapes like mysql_real_escape_string(). It is meant for writing SQL by hand – application code should use parameterized queries instead.
How to use SQL String Escape
- Choose the Escaping style: Standard SQL or MySQL.
- Optionally tick Wrap the result in single quotes.
- Type or paste the raw value into the input box.
- Copy the escaped output into your SQL.
Example
O'Reilly \ x
O''Reilly \ x
Standard SQL mode: quotes are doubled, the backslash stays.
When to use SQL String Escape
Use it to write one-off SQL statements, seed data or migration scripts containing text with apostrophes. Do not use string escaping as SQL-injection protection in applications – use prepared statements with bound parameters. Escaping identifiers (table/column names) is a different problem and not covered.
How SQL String Escape works
Standard SQL (ANSI; PostgreSQL, SQLite, SQL Server, Oracle and MySQL with NO_BACKSLASH_ESCAPES): each ' becomes ''; backslashes are literal and stay unchanged. MySQL mode (default MySQL/MariaDB settings): \0, newline, carriage return, backslash, ', " and Ctrl+Z (0x1A) are prefixed with a backslash, matching mysql_real_escape_string(). Line breaks in standard mode are left as real line breaks, which is valid inside SQL literals.
Common Use Cases
- Inserting names like O'Reilly in a manual INSERT
- Writing seed or migration scripts with quoted text
- Preparing literal strings for MySQL dumps
- Understanding the difference between ANSI and MySQL escaping
Security Note
Escaping does not replace prepared statements. Everything runs locally; nothing is sent to a server.
FAQs
Is escaping enough to prevent SQL injection?
No. Use parameterized queries; escaping is error-prone and depends on server settings and character set.
Which mode should I use for PostgreSQL?
Standard SQL. Since PostgreSQL 9.1, backslashes in ordinary strings are literal.
Why does MySQL need different escaping?
By default MySQL treats backslash as an escape character inside strings, so backslashes must be escaped too.