SQL Escape / Unescape
This SQL escaper doubles single quotes, which is how the SQL standard escapes a quote inside a string literal and the one rule that applies to every database. An optional mode also doubles backslashes for MySQL and MariaDB, which process backslash escapes inside literals unless NO_BACKSLASH_ESCAPES is set — leave it off for PostgreSQL, SQL Server, SQLite and Oracle. Note that escaping by hand is not what prevents SQL injection: parameterised queries are, because the value never becomes part of the statement text. Use this for literals you write into a migration or fixture by hand.
How it works
Doubles single quotes, which is how the SQL standard escapes a quote inside a string literal — the one rule that applies to every database.
Escaping a value by hand is a last resort. Parameterised queries are what actually prevent SQL injection, because the value never becomes part of the statement text. Use this for literals you are writing into a migration or a fixture by hand, not for user input in application code.
Escaping runs entirely in your browser — nothing you paste is sent to a server.
0 characters in · 0 characters out
How to escape a SQL string
- Paste the value into the input on the left.
- Turn on the MySQL option if your database also treats backslash as an escape.
- Copy the result into your string literal.
Use parameters, not escaping
Escaping by hand is not what prevents SQL injection — parameterised queries are, because the value never becomes part of the statement text and so can never be read as syntax. Reach for this tool when you are writing a literal into a migration, a seed script or a fixture by hand. Do not build application queries by escaping user input.
Standard SQL versus MySQL
The SQL standard has exactly one escape inside a string literal: a single quote is written twice. MySQL adds
backslash escapes on top of that unless the NO_BACKSLASH_ESCAPES mode is set, which means a literal
backslash in your data has to be doubled for it to survive. Turn the option on for MySQL and MariaDB; leave it off
for PostgreSQL, SQL Server, SQLite and Oracle.
Common use cases
- Writing seed data containing apostrophes — names like O'Brien are the classic case.
- Putting a Windows file path into a MySQL literal without losing the backslashes.
- Reading an escaped value back out of a migration to check it.
Frequently asked questions
How do I escape a single quote in SQL?
Write it twice. A name like O'Brien becomes O''Brien inside the literal. This is the SQL standard and works on every database.
Does escaping protect me from SQL injection?
No — parameterised queries do. With a parameter the value never becomes part of the statement text, so it cannot be read as syntax no matter what it contains. Use hand-escaping only for literals you are writing yourself in a migration, seed script or fixture.
When should I turn on the MySQL option?
For MySQL and MariaDB, which treat backslash as an escape character inside string literals unless NO_BACKSLASH_ESCAPES is enabled. Leave it off for PostgreSQL, SQL Server, SQLite and Oracle, where a backslash is an ordinary character.
What happens to a Windows path in MySQL?
Its backslashes must be doubled, or MySQL will read them as escape sequences and silently mangle the value. Turn the MySQL option on and that is handled.
Is my data sent to a server?
No. Escaping happens entirely in your browser.
Related tools
CSV Escape / Unescape
This CSV escaper quotes a field only when it needs it, and doubles any quotes inside.
JavaScript Escape / Unescape
This JavaScript escaper prepares any text to sit inside a string literal without breaking it.
CSV to JSON Converter
This CSV to JSON converter turns CSV rows into a JSON array, keyed automatically by the header row.