Turn untrusted text into a safe literal for SQL, HTML, or a JavaScript string.
This escapes characters that would otherwise break out of a string literal or get rendered as markup. It is not a substitute for parameterized queries - always use them for real SQL. This is for the cases where you need to see, log, or hand-paste an already-escaped value.
Type or paste text - the SQL, HTML, and JavaScript-escaped versions all appear below it at once, so you can grab whichever one you need.
No - it's for cases where you need to see, log, or hand-paste an already-escaped value. Always use parameterized queries for real SQL, never string concatenation.
Single-quote doubling, the ANSI-standard approach that works consistently across Postgres, SQLite, and MySQL alike, rather than MySQL-specific backslash-escaping.
No, it's framed and named as a defensive escaping tool, the opposite of a payload generator.
28 visits