Quick Answer
The most robust approach is to use `s.replace("'", "''")` because SQL’s standard escape mechanism for single quotes is to double them, not to use a backslash. This method, defined by the ISO/IEC 9075 SQL standard, ensures that a single quote in user input becomes two single quotes within the SQL string, preventing injection while preserving the literal quote. On the Certified Associate Python Programmer PCAP exam, this tests your understanding of safe string handling in Python when interacting with databases—a common trap is assuming backslash escaping works universally, but that is database-specific and not portable. Remember the memory tip: in SQL, to escape a single quote, you simply double it—think of it as “two for one” to keep the quote literal and the query safe.
This PCAP practice question tests your understanding of strings. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A programmer is writing a script to generate SQL queries safely. They need to escape single quotes in user-provided strings to prevent injection. Which approach is most robust?
s.replace("\\'", "'")
Why wrong: This replaces backslash-quote with quote, not escaping.
s.replace("'", "\\'")
Why wrong: This adds a backslash, which is not standard SQL escaping.
s.strip("'")
Why wrong: This removes surrounding quotes, not escaping internal ones.
s.replace("'", "''")
In SQL, single quotes are escaped by doubling them.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
s.replace("'", "''")
Option D is correct because in SQL, single quotes are escaped by doubling them (''), not by using backslashes. This is the standard escape mechanism defined by the SQL standard (ISO/IEC 9075) and is supported by databases like PostgreSQL, SQLite, and Oracle. Using `s.replace("'", "''")` ensures that a single quote in user input becomes two single quotes in the SQL string, preventing injection while preserving the literal quote.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
s.replace("\\'", "'")
Why it's wrong here
This replaces backslash-quote with quote, not escaping.
s.replace("'", "\\'")
Why it's wrong here
This adds a backslash, which is not standard SQL escaping.
s.strip("'")
Why it's wrong here
This removes surrounding quotes, not escaping internal ones.
s.replace("'", "''")
Why this is correct
In SQL, single quotes are escaped by doubling them.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Python Institute often tests the misconception that backslash escaping is universal in SQL, leading candidates to choose Option B, but the PCAP exam expects knowledge of the standard SQL escape mechanism (doubling quotes) as the most robust method.
Detailed technical explanation
The SQL standard uses doubled single quotes for escaping, so the string `O'Brien` becomes `O''Brien` in a query. Backslash escaping is a MySQL-specific extension that can be disabled via the `NO_BACKSLASH_ESCAPES` SQL mode, making it unreliable. In real-world scenarios, parameterized queries (prepared statements) are even more robust than manual escaping, but when dynamic SQL is unavoidable, doubling quotes is the portable, standard-compliant approach.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Strings — study guide chapter
Learn the concepts, then practise the questions
Strings practice questions
Targeted practice on this topic area only
All PCAP questions
511 questions across all exam domains
Certified Associate Python Programmer PCAP study guide
Full concept coverage aligned to exam objectives
PCAP practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCAP questions linked to Modules and Packages.
Practise PCAP questions linked to Strings.
Practise PCAP questions linked to Object-Oriented Programming.
Practise PCAP questions linked to Exceptions and File I/O.
Practise PCAP questions linked to PCAP fundamentals.
Practise PCAP questions linked to PCAP scenario.
Practise PCAP questions linked to PCAP troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Strings — This question tests Strings — Read the scenario before looking for a memorised answer..
The correct answer is: s.replace("'", "''") — Option D is correct because in SQL, single quotes are escaped by doubling them (''), not by using backslashes. This is the standard escape mechanism defined by the SQL standard (ISO/IEC 9075) and is supported by databases like PostgreSQL, SQLite, and Oracle. Using `s.replace("'", "''")` ensures that a single quote in user input becomes two single quotes in the SQL string, preventing injection while preserving the literal quote.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 30, 2026
This PCAP practice question is part of Courseiva's free Python Institute certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCAP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.