SQL Escape Tool

Escape or unescape SQL string literals. Prevent SQL injection by properly escaping quotes and special characters.

  1. Home
  2. Encoder & Decoder
  3. SQL Escape Tool

Escape

0 chars | 0 bytes UTF-8

Unescape

0 chars | 0 bytes UTF-8

Security note: escaping string literals is a fallback, not a substitute for parameterized queries (prepared statements). Prefer prepared statements whenever possible, and use escaping only for dynamic SQL or to build identifier allowlists.

What is SQL Escaping?

SQL escaping is the process of converting special characters in string literals to their SQL-safe representations. The most critical character to escape in SQL is the single quote ('), which is used to delimit string values. A single quote inside a string is typically escaped by doubling it ('') in standard SQL, or by using a backslash (\') in MySQL with NO_BACKSLASH_ESCAPES disabled.

For example, the name John O'Brien becomes 'John O''Brien' when properly escaped as a SQL string literal.

SQL Escape Methods by Database

DatabaseQuote EscapeBackslash EscapeNotes
PostgreSQL''N/A (standard)Uses standard SQL escaping
MySQL'' or \'\\Backslash escaping by default
SQLite''N/A (standard)Follows standard SQL
SQL Server''N/AStandard SQL only
Oracle''N/AStandard SQL only

How to Use This SQL Escape Tool

  1. Escape — Type or paste SQL string content into the left panel. The escaped result appears instantly as you type; you can also press Escape or Ctrl/Cmd + Enter to convert special characters to SQL-safe sequences.
  2. Unescape — Type or paste escaped SQL content into the right panel. The unescaped result appears instantly as you type; you can also press Unescape or Ctrl/Cmd + Enter to revert escape sequences to their actual characters.
  3. Options — Toggle Escape backslashes for MySQL mode, or Wrap in single quotes to surround the output with quotes. Options re-run the conversion automatically.
  4. Swap & Clear — Click Swap to exchange escape/unescape values, Clear All to reset everything.

SQL Escaping vs Prepared Statements

Escaping is a useful fallback, but it is not the recommended default for preventing SQL injection. Wherever your database driver supports them, use parameterized queries (prepared statements) instead.

ConcernManual escapingParameterized queries
Prevents SQL injectionPartial — string literals onlyStrong — data is never parsed as SQL
Handles string valuesYesYes
Handles identifiers (table/column names)NoNo — use allowlists instead
Risk of mistakesHighLow
Recommended defaultNoYes

Common Use Cases

  • SQL injection prevention — Always escape string values containing user input before building SQL queries to prevent SQL injection attacks.
  • Dynamic query building — Properly escape strings when constructing dynamic SQL queries in application code.
  • Database migration scripts — Ensure string data with special characters is correctly escaped in SQL migration files.
  • Debugging SQL logs — Unescape escaped SQL strings in database logs to read the actual query content.
  • Data import/export — Escape strings containing quotes, backslashes, and control characters when preparing SQL dump files.

Frequently Asked Questions

What characters need escaping in SQL strings?

The single quote (') must always be escaped in SQL string literals by doubling it (''). In MySQL (with default settings), the backslash (\\), double quote ("), and control characters like newline (\n) and tab (\t) are also escaped with a backslash prefix.

Should I use parameterized queries instead of escaping?

Yes! Parameterized queries (prepared statements) are the recommended way to prevent SQL injection. Escaping is a fallback for cases where parameterized queries aren't possible, such as dynamic SQL or when building queries in code that doesn't support prepared statements.

What is the difference between standard SQL and MySQL escaping?

Standard SQL (used by PostgreSQL, SQLite, SQL Server, Oracle) only escapes single quotes by doubling them (''). MySQL, by default, also treats backslash as an escape character, so \', \\, \n, etc. are recognized. This tool's Escape backslashes option enables MySQL-compatible escaping.

Does escaping prevent all SQL injection?

No. Escaping string values only protects string literals. SQL injection can also occur through other query parts (identifiers, numbers, keywords). Always validate and sanitize all user input, use parameterized queries, and follow the principle of least privilege for database accounts.

What about double quotes in SQL?

In standard SQL, double quotes are used to delimit identifiers (column names, table names), not string values. MySQL can use double quotes for strings when ANSI_QUOTES mode is disabled. This tool focuses on single-quoted string literals, the most common case.

Related Formatters & Escapers

SQL Formatter

Beautify and format SQL queries

Try it

SQL Minifier

Compress and minify SQL queries

Try it

JSON Escape / Unescape

Escape or unescape JSON strings

Try it

XML Escape / Unescape

Escape or unescape XML special characters

Try it

HTML Entity Encoder & Decoder

Encode or decode HTML entities

Try it

HTML Minifier

Compress and minify HTML code

Try it