SQL Escape🔒 100% local
Escape/unescape SQL strings for Postgres, MySQL, SQLite, SQL Server. Shows prepared-statement placeholders — the safe way.
Related Tools
Takes text and shows four ways to make it safe inside a SQL statement: standard single-quote doubling, a PostgreSQL dollar-quoted wrapper, a MySQL backslash escape, and a suggested parameterised form. It handles both escaping and reading back, so a value you paste comes out ready to drop into a query. The text is processed in the browser with no network call.
How to use it
- Paste the value or SQL fragment into the input box.
- Press Process. Four labelled sections appear: standard, PostgreSQL dollar-quoting, MySQL backslash, and a prepared-statement example.
- Copy the section that matches your database, or Clear to start over.
Worked example
O'Reillybecomes=== Single-quote escape (standard SQL) ===
'O''Reilly'
=== PostgreSQL dollar-quoting ===
$tagjjjw7a$O'Reilly$tagjjjw7a$
=== MySQL backslash escape (SET NO_BACKSLASH_ESCAPES=OFF) ===
'O\'Reilly'
=== Prepared statement (recommended - prevents injection) ===
'O'?'
=== Tips ===
- ALWAYS use prepared/parameterized statements in application code.
- This tool is for ad-hoc scripts / manual queries / debugging only.
- For Postgres: use $tag$...$tag$ to avoid any quote escaping.
- For MySQL/MariaDB: backslash escapes are ON by default - use doubling if server has NO_BACKSLASH_ESCAPES.Computed in Node. The dollar-quote tag is generated at random on each run, so the tag shown here will differ; the escape characters in the MySQL line (backslashes) are exactly what the tool prints.
it's a 100% matchbecomes'it''s a 100% match'The standard section alone, showing that the single quote is doubled and other characters are untouched.
When to use it
- Patching a value into a one-off admin query or a psql session where a parameter binding is not available.
- Sanity-checking how a given database expects an embedded apostrophe to be written.
- Preparing a string for a migration script you will paste into a file, rather than running through an application.
What it does not do
- Nothing here protects an application. The advice to use parameterised statements is printed with the output, and the 'Prepared statement' section is only an illustration, not a binding: for input containing a quote it prints a placeholder spliced into the surrounding quotes ('O'?'), which is not a runnable query.
- The dollar-quote tag is random on every run, so you cannot generate the same wrapped string twice or share a reproducible snippet.
- The MySQL section assumes backslash escapes are enabled. On a server set to NO_BACKSLASH_ESCAPES the escaping is wrong, and the tool does not detect the server mode.
- Escaping is a last resort. Different databases and drivers disagree on backslashes and on how multi-statement input is handled, so an escaped string is not a substitute for a bound parameter.