Text UtilitiesLesson 96Free preview

SQL Escape

This lesson is part of Web Developer Tools · All levels

Summary

SQL escape makes text secure for inclusion in a query by marking characters that have a specific meaning, especially single quotes. In standard SQL, a single quote in a string is written double, for example 'It's'. MySQL also knows the escape backslash, but that's not portable. Escaping only prevents syntax errors; to prevent SQL injection, use prepared statement.

Key points

SQL strings are wrapped up with single quotes and quotes are doubled in them
MySQL supports escape backslash like 'but not all databases
Manual escaping is prone to error and not a primary defense
In LIKE, the characters % and _ also need to be noted
Prepared statement with parameters is safer than compiling manual query

Full lesson

Code examples and quizzes

Full lessons, code examples, and quizzes are available to subscribers. 5 questions.