SQL Escape
Escapes or unescapes a SQL string, doubling single quote characters that could prevent execution.
Loading tool...
SQL string escaping explained
Why escape?
In SQL a string literal is delimited by single quotes. A single quote inside the value would terminate the literal early and either cause a syntax error or let the rest be executed as SQL. The standard way to represent a literal single quote is to double it: ''.
Rules applied
| Character | Standard SQL | MySQL backslash style |
|---|---|---|
Single quote ' |
'' |
\' |
Double quote " |
unchanged | \" |
Backslash \ |
unchanged | \\ |
| Newline | unchanged | \n |
The standard style (ANSI SQL-92) is understood by every relational database. The backslash style is a MySQL extension.
Use prepared statements, not escaping
Escaping only protects string literals. Every modern database driver supports parameterized queries: the SQL text and the values travel separately. This is the only reliable defense against SQL injection.