[Vince]

With SQLIte use %q for strings in format(), with MySQL use %e for strings in mysql_format. That's sufficient. In other languages (e.g. PHP) use prepared queries.

Interactive demo: https://www.codebashing.com/sql_demo