How are you turning the user supplied string<p><pre><code>   Gijs in &#x27;t Veld
</code></pre>
into the SQL string literal string<p><pre><code>   &#x27;Gijs in \&#x27;t Veld&#x27;
</code></pre>
?<p>Is your method for doing so guaranteed to always produce a valid SQL string literal which represents the supplied string? Even if the user supplied string contains, for example:<p>* control characters
* NULs
* non-ASCII characters
* Unicode combining characters
* surrogate pairs<p>...?<p>Wouldn&#x27;t it be nice <i>not to have to worry about that</i>?<p>Good. Then use a mechanism that lets you send the parameters as data outside of your SQL, such as parameterized prepared statements.