How to use the SQL Escape String Tool
1. Paste your string value in the input box.
2. Choose Escape (to SQL) or Unescape (from SQL).
3. Click the action button — the result is ready to paste into your SQL query.
What is it?
SQL injection happens when user input is concatenated into SQL queries without escaping. The correct defense is to use parameterised queries (prepared statements) — this tool is for generating static SQL safely in development tools, scripts, and seed files.
Standard SQL escaping replaces each single quote ' with two single quotes '' (not a backslash). Backslashes are also escaped in MySQL mode.
Example
John's car — it's fast!
'John''s car — it''s fast!'
Single quotes are doubled (SQL standard escaping). The result is wrapped in quotes, ready to paste into a query.
Benefits
Generate INSERT and CREATE TABLE statements instantly
Convert JSON, CSV, or a field list into ready-to-run SQL in seconds — no manual quoting, no counting columns, no copy-paste errors from spreadsheet data.
Build SELECT queries without memorising syntax
The visual query builder constructs WHERE conditions, ORDER BY, LIMIT, and DISTINCT clauses interactively — useful for anyone who writes SQL occasionally rather than daily.
Migrate between MongoDB and relational databases
Convert MongoDB find, insert, update, and delete operations directly to SQL equivalents — speed up data migration planning or schema exploration.
All your data stays in the browser
No SQL query, schema definition, or database content is ever uploaded to a server. Everything runs entirely client-side, making these tools safe to use with sensitive data.
Frequently asked questions
Should I escape strings in production application code?
No — use parameterised queries (prepared statements) in your database library. String escaping is error-prone; parameterised queries are the safe, correct solution.
Why are quotes doubled instead of backslash-escaped?
Doubling single quotes ('') is the SQL standard method that works across all databases. Backslash escaping (\') is MySQL-specific and can break on other databases.