DocomintEscape SQL String
Escape single quotes in a string so it's safe to use as a literal inside a SQL query.
Doubles every single quote in a string (O'Brien becomes O''Brien), the standard SQL escaping every major database understands — useful for quickly building a one-off literal by hand in a console or script. In application code, always use parameterized queries/prepared statements instead of string-escaping to build SQL with user input; this tool is for ad-hoc use, not a substitute for that.
Example: "O'Brien's Diner" becomes "O''Brien''s Diner" — safe to drop inside SQL single quotes.
How it works
- Paste a string containing single quotes
- Every single quote is doubled, instantly on your device
- Copy the escaped literal into your query
Frequently asked questions
Is manually escaping quotes safe against SQL injection?
Not reliably for application code handling user input — quote-doubling is the standard SQL literal-escaping rule, but parameterized queries/prepared statements are the actual defense against injection. Use this tool for quick, trusted, ad-hoc use, not as an input-sanitization strategy.
Is my data uploaded anywhere?
No — Escape SQL String runs entirely in your browser using JavaScript/WebAssembly. Your data is never sent to a server.
Does this also escape double-quoted identifiers, like column or table names?
No — this escapes single-quoted string literals only. Double-quoted identifiers use a different escaping rule (doubling the double quote) and aren't handled by this tool.