SQL Escape/Unescape

Escape and unescape SQL string literals: doubles single quotes and adds MySQL-style backslash escapes. Use parameterized queries for user input.

EscapeUnescapeSQLMySQL
Plain Text
18 chars
Escaped Output

Output will appear here

Start typing to see live output

All escaping/unescaping happens locally in your browser — your data never leaves your device.

In SQL, a string literal sits between single quotes, so a quote inside the value has to be escaped or it ends the string early: O'Brien must be written as 'O''Brien'. This tool turns plain text into a form you can paste between single quotes in a SQL statement, and turns escaped literals back into plain text.

Escaping follows MySQL / MariaDB conventions. Single quotes are doubled (' becomes ''), and backslash escapes are applied to backslashes (\\), double quotes (\"), newlines (\n), carriage returns (\r), tabs (\t) and NUL bytes (\0). Doubled quotes are standard SQL and work in every database, but backslash escapes are MySQL-specific. PostgreSQL (with its default standard_conforming_strings), SQL Server, SQLite and Oracle treat a backslash as an ordinary character, so for those databases the output is only correct when the input contains no backslashes, double quotes, tabs or line breaks.

Use it to prepare literals by hand: seed data, a one-off migration, a query for a bug report or a test fixture. It is not a defence against SQL injection. Application code should send values as query parameters (prepared statements), which keeps data separate from the SQL text, instead of escaping strings and concatenating them. Once the statement is written, the SQL formatter can lay it out readably.

  1. Choose Escape or Unescape. Switching modes clears the input.
  2. Paste the raw value, without the surrounding quotes. The output updates as you type.
  3. Copy the result and place it between single quotes in your statement, for example WHERE name = 'O''Brien'.
  4. To read a literal copied from a dump or a log, switch to Unescape and paste only the text between its quotes.
  5. Use Swap to feed the output back in and confirm it converts back to the original.

  • Doubles single quotes, the standard SQL escape
  • MySQL-style backslash escapes for \, ", newline, carriage return, tab and NUL
  • Unescape mode that reverses both doubled quotes and backslash sequences
  • Live output with character counts
  • Swap button to test a round trip
  • Runs in the browser; input is not uploaded

A name with apostrophes

Input:  O'Brien's Database
Output: O''Brien''s Database

SELECT * FROM customers WHERE company = 'O''Brien''s Database';

Doubled quotes are valid in MySQL, PostgreSQL, SQL Server, SQLite and Oracle.

A Windows path

Input:  C:\Users\data
Output: C:\\Users\\data

Correct for MySQL, where a backslash starts an escape. In PostgreSQL or SQL Server this output would store two backslashes, so use the original path there.

A multi-line value

Input (2 lines):
first line
second line

Output:
first line\nsecond line

MySQL reads \n inside a string as a newline, so the value fits on one line of SQL.

Double quotes

Input:  She said "hi"
Output: She said \"hi\"

MySQL turns \" back into ". Databases without backslash escapes would keep the backslashes, and there the double quotes need no escaping at all.

ERROR 1064: You have an error in your SQL syntax

The escaped value was pasted into the statement without surrounding single quotes, so its words and symbols are parsed as SQL.

Wrap the escaped value in single quotes: WHERE name = 'escaped value'.

Stored values contain extra backslashes

MySQL-style escapes were used with PostgreSQL, SQL Server or SQLite, which keep backslashes as literal characters.

For those databases, only double the single quotes, or better, pass the value as a query parameter.

The database stores O''Brien with two quotes

The value was escaped twice, or an escaped value was passed as a query parameter. Parameters must be raw values; the driver handles quoting.

Escape exactly once when writing SQL by hand, and never escape values you pass as parameters.

PostgreSQL: unterminated quoted string at or near "'..."

The literal uses \' to escape a quote, as found in MySQL dumps. PostgreSQL does not treat \' as an escape, so the string ends at that quote.

Replace \' with '' in the literal. For a value with no other backslash sequences, run it through Unescape and then Escape to get the doubled-quote form.

Does escaping strings protect against SQL injection?

Not reliably, and it is not what this tool is for. Correct escaping depends on the database, the connection character set and settings such as MySQL's NO_BACKSLASH_ESCAPES, and it does nothing for values placed outside quotes, such as numbers or ORDER BY columns. Use parameterized queries, where the driver sends values separately from the SQL, for example WHERE email = ? or WHERE email = $1.

Which databases is the output valid for?

All of it is valid for MySQL and MariaDB in their default SQL mode. For PostgreSQL, SQL Server, SQLite and Oracle, only the doubled single quotes are meaningful. If the input contains backslashes, double quotes, tabs or line breaks, the output will add backslashes that those databases store literally.

Why doesn't the output include the surrounding quotes?

So it can be pasted into a statement you already have. Wrap it in single quotes yourself, for example VALUES ('O''Brien').

Does it escape % and _ for LIKE patterns?

No. % and _ are wildcards only inside LIKE, and escaping them is a separate step: in MySQL, write \% and \_, and in any database you can declare an escape character with LIKE '50!%' ESCAPE '!'.

Can I use this for table or column names?

No. Identifiers are quoted differently: "double quotes" in standard SQL and PostgreSQL, `backticks` in MySQL and [square brackets] in SQL Server. This tool only handles string values.

How do I store a JSON string in a text column?

Escape in two layers, innermost first. Make the value valid JSON with the JSON escape tool, then escape the resulting JSON text here so it can sit inside a SQL string literal.