SQL Escape
Escape text for a SQL string literal — quotes, backslashes and control characters handled correctly.
Input
Output
Ready
Drop a file to load it
About this tool
Make arbitrary text safe to place inside a SQL literal. Doubles single quotes for ANSI SQL, with a MySQL mode that uses backslash escapes.
When you would use it
- Embedding text in SQL source safely
- Preparing a fixture or test value
- Neutralising characters that would break the surrounding syntax
Worked example
He said "hi" C:\temp
He said "hi" C:\temp
Things worth knowing
- Escaping and unescaping are exact inverses: running one then the other returns your original text byte for byte.
- Unescaping is done in a single pass, so a literal backslash followed by
nis not mistaken for a newline — a bug that affects many escaping tools. - String escaping is not a substitute for parameterised queries. Use bound parameters in application code; this tool is for fixtures, migrations and one-off scripts.
Questions
Frequently asked
Does this round-trip exactly?
Yes. Escaping then unescaping returns your input unchanged, including backslashes, newlines and emoji. That property is covered by the test suite.
Is escaping enough to prevent SQL injection?
No. Always use parameterised queries or prepared statements in application code. Escaping is for cases where parameters are not available, such as generating a migration or a fixture file.
Is my data uploaded anywhere?
No. Every tool on JSONWorks runs entirely in your browser using JavaScript. Your input is never sent to a server, never logged and never stored. The simplest proof is to disconnect from the internet — the tools keep working. The site does load Google Fonts and a Google Analytics page-view tag, so you will see those two requests in your network tab, but neither receives anything you type or paste.
Related