You can call the mysql_hex_string() function to create a valid SQL string.
Syntax
unsigned long
mysql_hex_string(char *to,
const char *from,
unsigned long length)
The string in the from argument is encoded in hexadecimal format, with each character encoded as two hexadecimal digits.
The length of the string that from points to must be length bytes. Therefore, at least length*2+1 bytes must be allocated to the buffer.
The result is placed in the to argument, followed by a terminating null character. When mysql_hex_string() returns, the content of to is a null-terminated string. The return value is the length of the encoded string, excluding the terminating null character.
The return value can be placed into an SQL statement by using the X'value' or 0xvalue format. However, the return value does not include X'...' or 0x.
Return values
The length of the encoded string is returned, excluding the terminating null character.
Errors
None.