SQL String Escape
Escape any string for safe embedding in a SQL string literal — pick your dialect: MySQL backslash mode, PostgreSQL / ANSI quote-doubling, or SQL Server mode. Live per-character transformation table, worked examples, copy & download. Free, instant, and 100% client-side: your text never leaves your browser.
Honest disclaimer: escaping is a formatting aid, not a security boundary. For application code, parameterized queries (prepared statements) are always safer — they keep data and SQL code separate. Escaping only neutralizes characters inside one string literal, and only when the rules exactly match your database. Use this tool for scripts, seed data, and migrations — never as your app's injection defense.
0 characters
escape sequences: 0
input: 0 chars
output: 0 chars
delta: +0
| # | Character | Escaped as |
|---|---|---|
| Type something above to see each character's transformation. | ||
How to use the SQL escape tool
- Pick your dialect. MySQL uses backslash escapes (\' \\ \n \r \0 \Z). PostgreSQL / ANSI doubles the single quote (''). SQL Server also doubles the quote, with an optional
]→]]toggle for bracket-quoted identifiers. - Paste your raw string — or click an example preset to try instantly. Conversion is live.
- Inspect the per-character table to see exactly how each character was transformed, then copy or download the result. The stats bar shows how many escape sequences were added.
- Remember: this formats a string literal for manual SQL. In application code, prefer parameterized queries — escaping is not an injection defense.
Per-character escape reference
| Character | MySQL | PostgreSQL / ANSI | SQL Server | Notes |
|---|---|---|---|---|
| ' single quote | \' | '' | '' | The classic O'Brien case — verified in the examples below |
| " double quote | \" | " unchanged | " unchanged | Only MySQL treats " as special in string literals |
| \ backslash | \\ | \ unchanged | \ unchanged | Backslash is literal data in PG/MSSQL — escape it FIRST in MySQL |
| newline (LF) | \n | unchanged | unchanged | MySQL turns a real line break into a 2-char sequence |
| carriage return | \r | unchanged | unchanged | — |
| NUL byte | \0 | unchanged | unchanged | Zero byte — terminates C strings, hence escaped in MySQL |
| Ctrl+Z (SUB) | \Z | unchanged | unchanged | MySQL treats it as end-of-data in LOAD DATA contexts |
| ] right bracket | ] unchanged | ] unchanged | ]] (optional) | Only for QUOTENAME-style [identifier] escaping in T-SQL |
MySQL rules follow mysql_real_escape_string semantics. PostgreSQL assumes standard_conforming_strings=on (default since 9.1).
Worked examples
| # | Raw input | MySQL | PostgreSQL / SQL Server |
|---|---|---|---|
| 1 | O'Brien | 'O\'Brien' | 'O''Brien' |
| 2 | C:\Users\Rafsan | 'C:\\Users\\Rafsan' | 'C:\Users\Rafsan' (backslash untouched) |
| 3 | line1 ⏎ line2 (real newline) | 'line1\nline2' | 'line1 ⏎ line2' (newline untouched) |
| 4 | x' OR '1'='1 | 'x\' OR \'1\'=\'1' | 'x'' OR ''1''=''1' |
| 5 | Say "hi" | 'Say \"hi\"' | 'Say "hi"' (quotes untouched) |
| 6 | a NUL b SUB c (control bytes) | 'a\0b\Zc' | bytes pass through unchanged |
| 7 | Sales] | 'Sales]' (unchanged) | 'Sales]]' with the ] toggle (SQL Server) |
All examples above are machine-verified against the tool's engine (28 automated test vectors).
Frequently asked questions
Not reliably — do not treat escaping as a security boundary. Escaping only neutralizes special characters inside one string literal, and only when the rules exactly match your database and its sql_mode. A single mismatch (for example, doubling quotes for MySQL, where the backslash is the real escape character) re-opens the injection hole. Parameterized queries (prepared statements) keep data and SQL code separate, and are always the safer choice. Use this tool for one-off scripts, seed data, migrations, and learning — never as the security layer of application code.
MySQL backslash mode is for MySQL and MariaDB with default settings. PostgreSQL / ANSI mode — single quotes doubled to '' — is for PostgreSQL, SQLite, Oracle, and MySQL running with NO_BACKSLASH_ESCAPES. SQL Server mode is for T-SQL: it also doubles single quotes, with an optional toggle escaping ] as ]] for QUOTENAME-style bracket identifiers. When in doubt, check your driver documentation: the escaping rules must match the server.
History. MySQL inherited C-style backslash escapes such as \' \n and \0, so a backslash inside a MySQL string literal starts an escape sequence. PostgreSQL 9.1 and later enables standard_conforming_strings by default and follows the SQL standard: a backslash is ordinary data, and only the doubled single quote '' escapes a quote. Mixing the two corrupts data or breaks the string literal — which is why this tool keeps the modes separate.
Escape the backslash before the quote. If you turn ' into \' in a first pass and then escape backslashes in a second pass, the backslash you just introduced gets escaped again and the result no longer means what you intended. This tool processes each character in a single pass, so the order is always correct — but if you hand-roll chained replacements, always replace \\ before '.
Only inside LIKE patterns, where % and _ are wildcards — escape them there (usually with a backslash plus an explicit ESCAPE clause) in addition to escaping the string itself. Outside LIKE they are ordinary characters and need no escaping. This is a common follow-up bug: the string is safely quoted, yet the LIKE pattern still matches more rows than intended.
No — identifiers follow different rules than string values, and this tool escapes string literals only. Per dialect: MySQL uses backticks with `` doubled, PostgreSQL and SQLite use double quotes with "" doubled, and SQL Server uses brackets where ] is written ]]. For identifiers, prefer an allow-list of known names over escaping.
No. All escaping runs entirely in your browser with JavaScript — your text never leaves your device. You can disconnect from the internet after the page loads and the tool keeps working.
Free tool by NRTechStudio