Apostrophe
' (Apostrophe) is ASCII code point 39 (0x27), Unicode U+0027, and a printable punctuation character. It signals possession ("the dog's bone") or marks omitted letters in contractions ("don't"), doing two grammatical jobs with one tiny stroke. Programming languages split into camps over this character. C, C++, and Java reserve single quotes for character literals — 'A' is a char, "A" is a string. JavaScript and Python treat single and double quotes as interchangeable string delimiters, which sounds convenient until you embed one inside the other. SQL uses single quotes exclusively for string values, and that's where the real damage happens: an unescaped apostrophe in user input is the classic entry point for SQL injection. The query SELECT * FROM users WHERE name = 'O'Brien' breaks in half at the second quote, and everything after it becomes executable SQL. Parameterized queries exist precisely because this one character has caused billions of dollars in breaches. ASCII chose a single vertical tick as a compromise — typewriters and telegraphs couldn't distinguish between opening and closing quotation styles, so one glyph served for apostrophe, single open quote, and single close quote alike. UTF-8 encodes it as a single byte 0x27. Unicode classifies it as Po (Punctuation, Other) with the name APOSTROPHE. The curly variants ‘ (U+2018) and ’ (U+2019) are what word processors silently substitute, and pasting them into a terminal command or config file is a rite of passage every developer endures exactly once.
Technical Details
Code Example
</>
const char *s = "Don\'t"; // escape apostrophe in a double-quoted stringchar ch = '\''; // apostrophe as a character literalint is_ap = (ch == 0x27); // compare to ASCII 39
Frequently Asked Questions
In Bash, single quotes are strictly literal — no variable expansion. In Python and JavaScript, they're interchangeable for strings. In SQL, single quotes delimit string values ('text') while double quotes delimit identifiers ("column"). In JSON, only double quotes work.
In most languages, escape it: 'it\'s'. In Bash, you can't escape inside single quotes — instead, end the quote, add an escaped apostrophe, and restart: 'it'\''s'. In Python, use double quotes ("it's") or escape (it\'s'). SQL doubles it: 'it''s'.
If user input containing ' is inserted directly into a SQL query (e.g., ' OR 1=1 --), it can break out of the string context and execute arbitrary SQL. This is SQL injection — one of the most common security vulnerabilities. Parameterized queries prevent it by separating code from data.
Word processors silently replace straight quotes (') with curly 'smart quotes' (', '). These are different Unicode characters that code editors and compilers don't recognize as string delimiters. Result: syntax errors from invisible character substitution. Always use a code editor, never a word processor.