Encoders / Escapers / Crypto

SQL Escape

Escape a string literal so it is safe for SQL.

String0 chars

String (escaped)

Guide & explanation

SQL Escape prepares a string literal to be safely embedded in an SQL query.

Escaping styles

Style	Rule	Good for
`' -> ''`	Doubles single quotes	Standard SQL, PostgreSQL, Oracle, SQL Server
`" -> ""`	Doubles double quotes	Identifiers / ANSI_QUOTES mode
Backslash	`\'` `\\` `\n` ...	MySQL, MariaDB

Example

-- input: O'Brien
SELECT * FROM person WHERE name = 'O''Brien';

Security warning

For user-supplied values, always use a parameterized query / prepared statement. Manual escaping is error-prone and is not an adequate defense against SQL injection.