SQL String Escape
Escape a string value for MySQL, PostgreSQL, SQLite, or MSSQL (T-SQL). Shows both the escaped form and the fully-quoted literal. For reference and testing only — always use parameterized queries in production code. Runs in your browser.
Generate escaped and quoted SQL string-literal text for MySQL or MariaDB, PostgreSQL, SQLite, or MSSQL. It is a convenience helper for inspecting literal syntax, not a replacement for parameterized queries.
How to escape an SQL string literal
- Choose the SQL dialect.
- Enter the text you want to represent as a string literal.
- Review the escaped value and the quoted literal output.
- Copy either result if you need it for testing or inspection.
Dialect behavior
MySQL or MariaDB mode backslash-escapes backslashes, quotes, newlines, carriage returns, NUL and Ctrl-Z. PostgreSQL, SQLite and MSSQL modes double single quotes.
Quoted output uses normal single quotes for MySQL, PostgreSQL and SQLite, while MSSQL uses an N-prefixed string such as N'text'.
Privacy and security limitations
Escaping is performed in the browser and this application does not send the entered text to an external server. Do not use this helper as your SQL-injection defense: production database code should use prepared statements or parameter binding because server modes, encodings and driver behavior can affect literal parsing.
SQL Escape Helper FAQ
Can this replace prepared statements?
No. Use database-driver parameters or prepared statements for untrusted values.
Which SQL dialects are available?
MySQL or MariaDB, PostgreSQL, SQLite, and MSSQL T-SQL.
Why does MSSQL output start with N?
The helper emits an N-prefixed quoted literal in MSSQL mode.
Does PostgreSQL mode add E before the string?
No. This implementation only doubles single quotes and wraps the result in ordinary single quotes.
Does the tool execute SQL?
No. It only transforms text locally and does not connect to a database.