---
sourceDocument: Australia Build workflows
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/build-workflows

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Build workflows

ft:clusterId :

    - crworkflow

bundleId :

    - crworkflow

workflow :

    - Creator


---

# Sanitize SQL

# Sanitize SQL transform functions {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Use sanitize SQL transform functions to escape special characters and prevent injection
in String data pills to be used for SQL statements.
Sanitize SQL transform functions require a String input data pill. Make sure to use the
correct input [data pill type](https://servicenow-prod.fluidtopics.net/Ct3dsJ0IiWIcbamXVRVy2g "Actions and subflows use variables to store input and output data. The variable data type determines what kind of data it stores and its advanced configuration options.") when applying
sanitize SQL transform functions. If a sanitize SQL transform function is applied to an
improper data type, the data is not transformed at runtime and the input value is returned
instead. For more information on confirming your flow runtime values, see [Test a flow](https://servicenow-prod.fluidtopics.net/16GAKmUMqo2akmwgAuG1TA "Before activating a flow so other users can access it, test to make certain it works the way you expect.").  
Note:  
When a data pill is dropped into the SQL Statement input for a [JDBC step](https://servicenow-prod.fluidtopics.net/Kar6poz~OjqtUG7I0xdtJg "Create a reusable action to send SQL commands to a relational database."), the sanitize SQL transform function category automatically appears.

## Sanitize SQL Identifier {#sanitize-sql-transform-functions__section_wcw_2d1_kjb}

Returns a String with escaped special characters/injected values for SQL identifiers (such
as table, view, and column names). Wraps the input String in database-specific quotes.  
{#sanitize-sql-transform-functions__table_kpz_52y_lkb__entry__3}

| Input data pill | Parameters | Output data pill |
|-|-|-|
| String | Database - The database-specific context in which characters are escaped. Choices include MySQL, Oracle, PostgreSQL, and Microsoft SQL Server. | String - String with SQL identifiers that are properly escaped based on the selected database |
[ ]

{#sanitize-sql-transform-functions__table_kpz_52y_lkb}  
Figure 1. Example

* Input: `simple_column`
* Database: `MySQL`
* Output: ```simple_column```
{#sanitize-sql-transform-functions__ul_xfk_n21_kjb}  
Note:  
* If your input String contains a period character, Sanitize SQL Identifier returns an error. To join SQL identifiers using a period, use two data pills concatenated with a period and apply Sanitize SQL Identifier to both pills.
* Don't enclose the input data pill in quotes. The system automatically wraps the input value with the type of quotes or backticks that apply to your database type.
{#sanitize-sql-transform-functions__ul_cyx_gd1_kjb}

## Sanitize SQL Value {#sanitize-sql-transform-functions__section_izv_1g1_kjb}

Returns a String with escaped special characters or injected values for SQL values. Wraps the input String in database-specific quotes. {#sanitize-sql-transform-functions__table_onc_xgy_lkb__entry__3}

| Input data pill | Parameters | Output data pill |
|-|-|-|
| String | Database - The database-specific context in which characters are escaped. Choices include MySQL, Oracle, PostgreSQL, and Microsoft SQL Server. | String - String with SQL values that are properly escaped based on the selected database |
[ ]

{#sanitize-sql-transform-functions__table_onc_xgy_lkb}  
Figure 2. Example

* Input: <kbd class="ph userinput">'1'='1</kbd>
* Database: <kbd class="ph userinput">SQLServer</kbd>
* Output: <kbd class="ph userinput">''1''=''1'</kbd>
{#sanitize-sql-transform-functions__ul_zlz_1hy_lkb}  
Note:  
Don't enclose the input data pill in quotes. The system automatically wraps the input value with the type of quotes or backticks that apply to your database type.