SQL Escape
Escape quotes and backslashes so text is safe inside a SQL string literal.
Runs entirely in your browser.
Escape a String for SQL
About SQL Escape
A single quote ends a SQL string literal, so a quote inside the text has to be doubled: O'Brien becomes O''Brien. That doubling is standard SQL and works everywhere. Backslash escaping is doubled too here, which MySQL expects by default but PostgreSQL and SQLite do not treat specially.
Escaping by hand is not a substitute for parameterised queries. Bound parameters are what actually prevent SQL injection, because the value never becomes part of the statement text. Use this for literals you are writing into a migration or a one-off script, not for building queries out of user input.
Other Escaping Tools
- Escape / Unescape — every format on one page
- Regex Escape — escape regular expression metacharacters
- XML Escape — the five reserved XML characters
- CSV Escape — quote a value for a CSV field
- Backslash Escape — newlines and tabs as \n and \t
- HTML Entities — encode and decode HTML entities
- URL Encode / Decode — percent-encoding
- JSON Stringify — escape JSON into a string literal
