About the SQL Escape
In SQL a string literal is delimited by single quotes, and a single quote inside the string is written as two. That rule is part of the SQL standard and works in MySQL, PostgreSQL, SQL Server, Oracle, SQLite and every other engine. This tool applies it, so O'Brien becomes O''Brien, ready to paste between quotes in a query.
Nothing else is changed: double quotes, backslashes and newlines are valid inside a standard SQL string. MySQL additionally treats backslash as an escape character in its default mode, so a literal backslash there should be doubled as well; do that by hand if you target MySQL with backslashes in the text.
Escaping is for hand-written scripts and ad hoc queries. In application code, use parameterised queries instead; they avoid escaping entirely and are the only reliable defence against SQL injection. The SQL Unescape tool reverses the doubling.
How to use
- Paste the text.
- Copy the escaped version.
- Paste it between single quotes in your SQL.
Common questions
- Is this enough to prevent SQL injection?
- Not in application code. Use parameterised queries. Escaping is for scripts you write and run yourself.
- Should backslashes be escaped too?
- Only in MySQL and MariaDB with default settings. Standard SQL treats backslash as an ordinary character.
- What about double quotes?
- They are ordinary characters inside a single-quoted literal and are left alone.