SQL String Escaper
Escape text into a safe SQL string literal for MySQL, PostgreSQL, SQL Server, SQLite or Oracle.
Result
Type above to see the escaped string.
Or avoid escaping entirely
Escaping is a fallback. Parameterised queries and prepared statements are the only reliable defence against SQL injection — use them wherever your driver allows it.
Dialect notes
How it works
Type or paste any text and this tool turns it into a safe SQL string literal for the dialect
you pick. Doubling the single quote ('') is the escape defined by the SQL
standard, ISO/IEC 9075 character string literal, and it is what PostgreSQL, SQLite,
Oracle and SQL Server use. MySQL and MariaDB additionally treat the backslash as an escape
character, so for those the tool applies exactly the set that
mysql_real_escape_string() handles: NUL, newline, carriage return, backslash,
single quote, double quote and Ctrl-Z (0x1A).
Switch What to escape to LIKE pattern to also neutralise the
% and _ wildcards (plus [ on SQL Server) with the
escape character you choose; the tool appends the matching ESCAPE '…' clause so
the pattern behaves the way you expect. Identifier mode quotes table and column
names with the delimiter each dialect uses (backticks for MySQL, double quotes for
PostgreSQL, SQLite and Oracle, square brackets for SQL Server) and doubles any delimiter
inside the name. Set Direction to Unescape to go the other way and recover
the original text from a literal you copied out of a query or a log.
Everything runs in JavaScript on your device, so queries containing customer data, passwords or internal hostnames are never uploaded. One caveat worth repeating: escaping is a last resort. Parameterised queries and prepared statements are the only reliable defence against SQL injection, because they never mix data into the SQL text at all.
Frequently asked questions
How do I escape a single quote in a SQL string?
Double it. The SQL standard (ISO/IEC 9075) writes a quote inside a character string literal as two quotes, so O'Reilly becomes 'O''Reilly'. That works in PostgreSQL, SQLite, Oracle and SQL Server. MySQL and MariaDB accept it too, but they also treat the backslash as an escape character, so this tool switches to the backslash rules when you pick that dialect.
What does the tool escape for MySQL and MariaDB?
Exactly the characters mysql_real_escape_string() handles: NUL, newline, carriage return, backslash, single quote, double quote and Ctrl-Z (0x1A). If your server runs with NO_BACKSLASH_ESCAPES enabled the backslash is an ordinary character, so use the doubled-quote form instead. The page shows a note reminding you of that.
Does escaping protect me from SQL injection?
Not reliably. Escaping is a fallback for the cases where you cannot parameterise, such as generated migration scripts or a seed file. Prepared statements and parameterised queries never mix your data into the SQL text at all, which is why they are the only dependable defence. Use them wherever your driver allows it.