How to Escape Single Quotes in MySQL

TL;DR

There are two main ways to escape single quotes in MySQL: using a backslash (\) or by using double single quotes ('').

Using Backslash (\)

One common method for escaping single quotes is to prepend them with a backslash (\). This is a standard way of telling MySQL that the quote is part of the string and not a delimiter.

Example:

SELECT 'It\'s a beautiful day!' AS escaped_string;

In this example:

• The backslash (\) tells MySQL that the single quote in “It’s” should be treated as part of the string rather than as the end of the string.

The output will be:

escaped_string
----------------
It's a beautiful day!

Using Double Single Quotes ('')

Another way to escape single quotes is by using two single quotes (''). This is more commonly used in SQL queries, especially when inserting data into tables.

Example:

INSERT INTO messages (text) VALUES ('It''s a beautiful day!');

In this query:

• The two single quotes ('') within the string represent a literal single quote ('), allowing the query to execute properly.

This method is often preferred because it’s part of SQL’s standard handling of single quotes.

Example Queries

Here’s a real-world scenario: inserting a name with an apostrophe (which is the same as a single quote) into a database.

INSERT INTO customers (name) VALUES ('O''Connor');

In this example, the name “O’Connor” contains an apostrophe. To ensure the query runs without issues, we use two single quotes ('') to represent the apostrophe.

If we had not escaped the apostrophe, MySQL would interpret it as the end of the string, causing a syntax error.

SQL Injection Risks

One of the most significant risks when dealing with single quotes in SQL is SQL injection. If user input contains unescaped single quotes, malicious users could potentially craft input that manipulates your SQL queries, allowing them to access or damage your database. For example:

<?php
   $name = $_GET['name'];
   $query = "SELECT * FROM users WHERE name = '$name'";
?>

If someone enters a name like O'Connor, this could cause an error or, worse, be exploited with input like O' OR '1'='1, which could turn the query into something like:

SELECT * FROM users WHERE name = 'O' OR '1'='1';

This would return all records in the users table, a clear security breach.

How to Prevent SQL Injection

To prevent this, use prepared statements with bound parameters or use MySQL functions like mysql_real_escape_string() in PHP to sanitize inputs properly. Here’s an example using a prepared statement:

<?php
   $stmt = $pdo->prepare("SELECT * FROM users WHERE name = ?");
   $stmt->execute([$name]);
?>

This method ensures the input is safely handled and prevents SQL injection.

Query Syntax Errors

Another thing to be careful of is query syntax errors caused by unescaped quotes. Whenever a query includes single quotes inside a string, failing to escape them properly will cause a syntax error, leading to failed queries.

For example, without proper escaping:

INSERT INTO messages (text) VALUES ('It's your time to shine!');

This query will fail because MySQL thinks the string ends after It, causing a syntax error.

Corrected version:

INSERT INTO messages (text) VALUES ('It''s your time to shine!');

Always ensure that quotes inside strings are properly escaped to avoid such issues.

Conclusion

Escaping single quotes in MySQL is a critical step to avoid syntax errors and ensure your queries run smoothly. You can escape single quotes by using a backslash (\) or by doubling the quote (''), both of which are valid methods. While working with single quotes, be mindful of potential issues like SQL injection and query errors, and consider using prepared statements for user input to maintain the security of your database.

By understanding how to properly escape single quotes, you can write more robust, secure, and error-free SQL queries.

Further reading:

• MySQL String Literals
• Prepared Statements in PHP