title: How to escape SQL strings (not parameterized queries)
body: <p>I am trying to write an object-oriented layer for creating SQL queries for NodeJS, like Zend's DB component. So I want to be able to escape values. Yes, I know parameterized queries are ideal. But reasons I want escaping:</p>
  
  <ul>
  <li>I want to allow the created queries to be executed driver-agnostically (in terms of creating a platform-specific SQL string, instead of relying on one library's interface for parameterized queries), although I will add support for prepared queries for popular drivers</li>
  <li><a href="https://github.com/zendframework/zf2/blob/master/library/Zend/Db/Adapter/Platform/Mysql.php#L111" rel="nofollow noreferrer">Zend's Db component does escaping</a>, so it seems like it should be possible (safe)</li>
  <li>There is nothing like it for NodeJS I am aware of, so I can't find any examples or use another library's escape function</li>
  </ul>
  
  <p>Since Zend uses it, I started with this approach. I found examples for escaping strings for <a href="https://stackoverflow.com/questions/7744912/making-a-javascript-string-sql-friendly">MySQL</a> and <a href="http://www.postgresql.org/ftp/source/v9.2.4/" rel="nofollow noreferrer">PostgresSQL</a>, but didn't find anything for Sqlite3.</p>
  
  <p>I tried tracing PHP's <a href="http://php.net/manual/en/sqlite3.escapestring.php" rel="nofollow noreferrer">Sqlite3::escapeString</a> function, and ended up at <code>sqlite3VXPrintf</code> in sqlite3.c, line 19016, which is a massive printf function. I'm not even sure that's where I was supposed to end up. Anyways, I had no luck trying to understand it :P</p>
  
  <p>So I'm hoping someone can give me more pointers as to how to do this. And <em>what do I have to be aware of to make my escaping functions safe</em>? Why isn't replacing all <code>'</code> with <code>\\'</code> safe? I'm aware of flaws like second order SQL injection, but that's still because someone forgot to escape something. An interface for creating SQL queries could automatically quote values, unless the developer explicitly says "this is safe"</p>
  
  <p>While I'm at it, regarding the solution in the earlier <a href="https://stackoverflow.com/questions/7744912/making-a-javascript-string-sql-friendly">MySQL question</a>, it looks pretty simple (no special cases?). Is that really all there is to it? Assuming unsafeinput is <em>always</em> escaped. <a href="http://www.php.net/manual/en/mysqli.real-escape-string.php" rel="nofollow noreferrer">mysqli_real_escape_string</a> escapes NUL (ASCII 0), \n, \r, \, ', ", and Control-Z. <a href="http://www.sqlite.org/lang_expr.html" rel="nofollow noreferrer">Sqlite3's documentation</a> only mentions single quotes, but certain characters like NUL look fishy. Anywhere I can find out more about this?</p>
  
  <p>PostgresSQL's escape function in <a href="http://www.postgresql.org/ftp/source/v9.2.4/" rel="nofollow noreferrer">libpq</a> also looks like it's just replacing quotes with escaped quotes. I guess I'm just making sure this is okay because I always hear "use parameterized queries!" as if escape functions are useless.</p>
  
  <hr>
  
  <p><strong>TLDR</strong>:
  I have two main questions</p>
  
  <ol>
  <li>Is escaping special characters for queries safe if it is done properly and everywhere?</li>
  <li>Where can I find examples of Sqlite3 escaping code? The official docs only mention the single quote for literals (want to make sure), and I had no luck tracing PHP source.</li>
  </ol>