SQL string escape
Handy for a hand-written query or seed file with names like O'Reilly. In application code, always use parameterized queries.
Loading the tool…
Processing and privacy: The result is calculated inside your browser and your data is not sent to any server.
How to use it
- Enter database style and text.
- The result appears straight away and updates as you edit.
- Copy the result, or copy a link that keeps the same values to share it.
How it is calculated
Standard (PostgreSQL, SQLite, SQL Server, Oracle): every ' becomes ''. MySQL mode: \, ' and " get a backslash, NUL becomes \0, newline \n, carriage return \r and Ctrl+Z \Z, as mysql_real_escape_string does.
Example
Inputs: Database style = Standard: PostgreSQL, SQLite, SQL Server, Oracle. Result: SQL literal: 'O''Reilly''s book'.
O'Reilly's book
'O''Reilly''s book'
Limits and caveats
- This is not SQL injection protection for apps; parameterized queries are.
- For MySQL running with NO_BACKSLASH_ESCAPES, use the standard option.
- It does not produce PostgreSQL E'' strings or the SQL Server N prefix.
Questions about this tool
How do I put a single quote inside an SQL string?
In standard SQL you double it: 'O''Reilly'. MySQL accepts that too, as well as \'.
Why are backslashes left alone in standard mode?
Standard SQL treats the backslash as a normal character, so C:\temp is written as is in PostgreSQL and SQLite.
What about Arabic text in SQL Server?
Add the N prefix, as in N'مرحبا', when the column is NVARCHAR.