Which dialect should I pick?

Use Standard for PostgreSQL and SQLite, and for SQL Server or Oracle, which also just double single quotes. Use MySQL when backslashes act as escape characters in your server's string literals.

Does escaping stop SQL injection?

Not reliably. Doubling quotes helps in a hand-written literal, but it ignores other contexts and dialect settings. Parameterized queries or prepared statements are the dependable fix for user input.

Do I add the surrounding quotes myself?

Yes. The output is only the inside of the literal. Wrap it in single quotes in your statement, for example WHERE name = 'O''Brien'.

How do I reverse an escaped value?

Switch to Unescape. Pairs of single quotes become one, and with the MySQL option a doubled backslash and \0 are restored too. In Standard mode, backslashes are left alone, because that dialect never changed them.

SQL Escape / Unescape

Escape or unescape SQL string values.

Loading…

About SQL Escape / Unescape

A name like O'Brien ends a SQL string early unless the apostrophe is doubled, and what else needs escaping depends on the database. Choose a dialect, paste the value and the output is ready to place between your own single quotes. Standard doubles single quotes and nothing else, which fits PostgreSQL and SQLite. The MySQL option also doubles backslashes and writes NUL as \0. Unescape reverses whichever rule you picked.

Features

Doubles single quotes, the standard SQL string escape
MySQL option also escapes backslashes and NUL characters
Dialect menu with Standard (PostgreSQL, SQLite) and MySQL (escapes backslashes)
Unescape restores quotes, and in MySQL mode backslashes and NUL
Output refreshes when you change the dialect

Limitations

Only string-literal escaping is applied: no quotes are added, and LIKE wildcards, identifiers and numbers are not handled.
Escaping is not a substitute for parameterized queries, so use bound parameters for anything that comes from user input.
Only two dialects are offered, so engines with other backslash rules are not modelled.

How it works

Paste the value into the SQL Input panel.
Pick Escape or Unescape with the toggle, then choose a SQL dialect: Standard or MySQL.
Read the SQL Output panel, which updates as you type or change the dialect.
Select Copy Output and paste it between single quotes in your statement.

Example input

O'Brien's data \ backup

Frequently asked questions

: Use Standard for PostgreSQL and SQLite, and for SQL Server or Oracle, which also just double single quotes. Use MySQL when backslashes act as escape characters in your server's string literals.
: Not reliably. Doubling quotes helps in a hand-written literal, but it ignores other contexts and dialect settings. Parameterized queries or prepared statements are the dependable fix for user input.
: Yes. The output is only the inside of the literal. Wrap it in single quotes in your statement, for example WHERE name = 'O''Brien'.
: Switch to Unescape. Pairs of single quotes become one, and with the MySQL option a doubled backslash and \0 are restored too. In Standard mode, backslashes are left alone, because that dialect never changed them.