Skip to main content

SafeSQL

Function SafeSQL (const aValue : string) : string

Example​

procedure ScriptEvent(var Value: variant);
begin
  Value := SafeSQL('O''Brien'); // 'O''Brien' as a SQL literal: 'O' + doubled quote + 'Brien'
end;

Usage​

SafeSQL builds a single-quoted SQL text literal after deleting NUL characters and doubling apostrophes.

Security and correctness boundaries

  • Prefer parameters in every database API that supports them. Parameters keep data separate from SQL syntax, preserve types and avoid dialect-specific quoting mistakes.
  • The name does not guarantee safety for every SQL dialect, character set, collation or execution API. Backslash escapes, Unicode literal prefixes, connection modes and other syntax rules are not considered.
  • NUL removal is lossy: two distinct inputs can produce the same SQL literal.
  • This function does not validate SQL length, column type, encoding, truncation or semantic constraints.
  • Do not use the result as an identifier, table name, column name, keyword or complete SQL fragment. It only attempts to form a text literal.
  • Logging the returned value can disclose the original data.

SafeSQL and SQLString currently have identical behaviour.

Additional Technical Info​

SafeSQL converts a typed string into a single-quoted SQL literal. It removes every NUL character, doubles every apostrophe and adds one apostrophe at each end.

The example is fictional and source-reviewed only. In the comment, the returned literal contains outer quotes and the source apostrophe is represented by two adjacent apostrophes.

Transformation

'''' + StringReplace(
  StringReplace(aValue, #0, '', [rfReplaceAll]),
  '''', '''''', [rfReplaceAll]) + ''''
Input propertyOutput behavior
Empty string'' (a quoted empty SQL string).
ApostropheDoubled according to common SQL string-literal syntax.
NULDeleted, not escaped or rejected.
Other charactersCopied unchanged between the outer quotes.

Performance and concurrency

The value is scanned twice and intermediate strings are allocated. The function is otherwise stateless.

External references

Created 2026-07-15