SQL Parameterizer
Convert a SQL query with hardcoded values into a parameterized statement with bind placeholders ($1/$2, ?, or :p1/:p2) plus the extracted values as a JSON array. A deterministic tokenizer skips comments, identifiers, and keywords so only real string and numeric literals are replaced.
Input
Choose the placeholder syntax for your database driver.
Output
Guides
Turn a SQL query full of hardcoded literals into a parameterized statement with bind placeholders, and pull the values out into a clean JSON array you can pass straight to your database driver. Parameterized (prepared) statements are the single most effective defense against SQL injection — the database treats your values as data, never as executable SQL.
How to use it
- Paste a SQL query that has inline string or numeric literals.
- Pick the placeholder style that matches your driver.
- Choose whether to parameterize string literals, numeric literals, or both.
The tool rewrites the query, replacing each literal with a numbered placeholder, and lists the extracted values in order. Everything runs entirely in your browser — your SQL is never uploaded to a server.
Placeholder styles
- PostgreSQL — positional
$1,$2,$3(node-postgres,pg). - MySQL / SQLite — anonymous
?markers (mysql2, better-sqlite3). - Oracle / Named —
:p1,:p2named binds.
The extracted-values array is always in first-seen order, so it maps directly onto positional
placeholders and to :p1, :p2, … named binds alike.
What gets parameterized (and what doesn't)
A deterministic character-by-character tokenizer walks the query so only real literals are touched:
- String literals in single quotes, including ANSI doubled-quote escaping (
'O''Brien'becomes the valueO'Brien) and backslash escapes. - Numeric literals — integers, decimals, scientific notation, and hex (
0x1F).
Left completely untouched:
- Identifiers and keywords — table and column names like
col1orutf8mb4are never mistaken for numbers. - Quoted / delimited identifiers —
"user",`order`, and[Group]are copied verbatim. - Comments —
-- line,# line, and/* block */are preserved as-is. - A number glued to an identifier or immediately after
), a closing quote, or a bracket, so suffixes and expressions aren't corrupted.
Why parameterize instead of escaping?
Escaping quotes by hand is error-prone and driver-specific. Bind parameters remove the value
from the SQL text entirely, so there is no string for an attacker to break out of — and the
database can cache the prepared plan. This tool gives you the exact placeholder syntax plus the
ordered value list, so you can wire it into execute(sql, values) immediately.
Does it change my query's meaning?
No. Only literal values are extracted; the query structure, whitespace, comments, and identifiers are preserved byte-for-byte. Feed the parameterized SQL and the values array to your driver and you get the same result as the original hardcoded query — just safely.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/sql-parameterizer \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"inputSql": "SELECT id, name FROM users\nWHERE name = 'O''Brie…",
"placeholderStyle": "dollar",
"paramStrings": "true",
"paramNumbers": "true"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `sql-parameterizer` tool (SQL Parameterizer) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.