Escape / Unescape

SQL Escape / Unescape

Three escaping styles for SQL string literals — ANSI quote doubling, MySQL backslashes, or LIKE-pattern wildcards — and back again.

In short

SQL escaping makes a string safe to place inside a quoted literal. The ANSI rule, accepted by PostgreSQL, SQLite, Oracle, SQL Server and MySQL, is to double every single quote: O'Brien becomes 'O''Brien'. This tool also offers MySQL backslash escaping and LIKE-pattern escaping of % and _, each with an unescape mode. For application code, use parameterised queries instead.

By NaveenKumar T · Updated 18 Sep 2026

Learn: How to Escape a Single Quote in SQL

Escape & unescape in one tool
Handles every special character
Instant as you switch modes

Runs entirely in your browser — nothing you paste or open here is uploaded, logged, or stored.How we handle data →

Example

SQL Escape: input and output

A free-text note being inlined into an INSERT statement.

Text

Marc-Antoine d'Aubigné wrote: 'ça marche' — 100% sure
Export: C:\exports\q3'26.csv; retried at 09:15 -- don't retry again

SQL literal content

Marc-Antoine d''Aubigné wrote: ''ça marche'' — 100% sure
Export: C:\exports\q3''26.csv; retried at 09:15 -- don''t retry again

Only the single quotes were doubled; the backslashes, the semicolon, the percent sign and the -- sequence pass through unchanged because none of them is special inside an ANSI string literal.

Learn more

SQL escaping rules

In ANSI SQL, the string delimiter is the single quote, and the standard escape is doubling: a literal containing O'Brien is written 'O''Brien'. That style is the default here, and it's the form accepted by PostgreSQL, SQLite, Oracle, SQL Server, and (with standard settings) MySQL. Switch the Style control to MySQL for backslash escaping (\' and \\), or to LIKE pattern to also escape the % and _ wildcard characters — each style has its own unescape mode to reverse it.

A necessary word of caution: escaping is for the times you must hand-write a literal — migration scripts, ad-hoc analysis, seeding data. In application code, parameterized queries are the correct tool; they eliminate injection structurally rather than character by character.

How to escape a single quote in SQL (by database)

Every mainstream database accepts the same fallback — double the quote — which is why this tool's output drops safely into any of them. Several engines also support an alternative worth knowing when you're hand-writing a lot of literals:

Escaping a single quote, by database
Database	Escape a single quote	Also valid	Notes
MySQL	Double it: '' → 'O''Brien'	Backslash: \' → 'O\'Brien'	Backslash escaping only applies in the default sql_mode; it stops working once NO_BACKSLASH_ESCAPES is set, leaving doubling as the only option
PostgreSQL	Double it: '' → 'O''Brien'	Escape strings: E'O\'Brien', or dollar-quoting: $$O'Brien$$	standard_conforming_strings is on by default, so a plain 'string' never treats backslash as an escape — only an E'…' string does
SQL Server	Double it: '' → 'O''Brien'	N'O''Brien' for an nvarchar/Unicode literal	The N prefix marks the literal as Unicode text; it doesn't change how the quote itself is escaped
Oracle	Double it: '' → 'O''Brien'	Alternative quoting: q'[O'Brien]' or q'{O'Brien}'	q-quoting lets you pick delimiters that don't appear in the string, so the inner quote needs no escaping at all
SQLite	Double it: '' → 'O''Brien'	—	Follows the ANSI rule; there's no backslash-escape mode to opt into

Escaping LIKE wildcards and backslashes

Quote doubling only protects the string delimiter — it says nothing about the two characters that are special inside a LIKE pattern: % matches any run of characters and _ matches exactly one. A search value that happens to contain a literal percent sign or underscore (a discount code '50%OFF', a username 'j_smith') matches more rows than intended unless those characters are escaped too. Switch Style to LIKE pattern above and this tool escapes % and _ (and a literal backslash) automatically, alongside the usual quote doubling.

The escaped value still needs a database-level ESCAPE clause to mean anything: LIKE '50\%OFF' ESCAPE '\' tells the engine to treat the character after \ as literal rather than a wildcard. MySQL, PostgreSQL, and SQL Server all support a custom ESCAPE character this way, and this tool always uses backslash as the escape character — declare the same one in your query. One dialect note the LIKE style shares with MySQL style: MySQL in its default sql_mode also treats a bare backslash as a general string-escape character, so a literal backslash in a MySQL literal needs doubling (\\) — unless NO_BACKSLASH_ESCAPES is set, in which case MySQL follows the ANSI standard and a backslash is just a backslash (use ANSI style for that mode).

Why parameterised queries beat escaping

Escaping is correct for exactly the case this tool targets: a literal you're typing by hand into a script, a seed file, or an ad-hoc query. It's the wrong tool for building queries from variables in application code — assembling SQL text from user input is how injection happens, no matter how carefully each piece gets escaped. Parameterized queries (prepared statements with bind variables) send the SQL text and the data separately, so a value can never be reinterpreted as SQL syntax — a structural guarantee escaping can't match.

Help

Frequently asked questions

Everything you need to know about the SQL Escape.

01How do I escape or unescape SQL here?

Paste your text, pick Escape or Unescape and a Style (ANSI, MySQL, or LIKE pattern), and press Convert. Escape applies the chosen dialect's quoting or wildcard-escaping rule; Unescape reverses it for that same style.

02How do I escape a single quote in SQL?

Double it — replace every ' with '' inside the literal, so O'Brien becomes 'O''Brien'. That's the ANSI SQL rule this tool applies by default, and it's accepted unmodified by PostgreSQL, SQL Server, Oracle, SQLite, and MySQL; the table below covers the extra syntax each engine also supports.

03Does this protect against SQL injection?

Quote doubling closes the single-quote vector for string literals, but real injection defense is parameterized queries — they separate code from data entirely, structurally, rather than by escaping characters one at a time. Use this tool for hand-written scripts, fixtures, and migrations; use bind parameters in application code, always.

04How do I escape a value for use inside a LIKE pattern?

Switch Style to LIKE pattern. It backslash-escapes the two wildcard characters — % (any run of characters) and _ (exactly one character) — as well as a literal backslash, then doubles the quote as usual, so the result drops straight into LIKE '…' ESCAPE '\\'. Without this, a search value containing a real percent sign or underscore (a discount code '50%OFF', a username 'j_smith') matches more rows than intended.

05How do I escape a string for MySQL specifically?

Switch Style to MySQL. In MySQL's default sql_mode, a backslash is itself a general escape character, so both \ and ' need escaping — the MySQL style doubles every backslash to \\ and escapes the quote as \', which is what mysql_real_escape_string and most MySQL drivers produce. If the connection has NO_BACKSLASH_ESCAPES set, MySQL follows the ANSI rule instead — use the ANSI style in that case.

Keep working