Language: Java
Label: safe
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public static String escapeLiteral(
            String literal, boolean escapeBackslash, boolean escapeDoubleQuote) {
        // ' --> ''
        String escaped = SINGLE_QUOTE_PATTERN.matcher(literal).replaceAll("''");
        if (escapeBackslash) {
            // \ --> \\
            escaped = BACKSLASH_PATTERN.matcher(escaped).replaceAll("\\\\\\\\");
        }
        if (escapeDoubleQuote) {
            // " --> \"
            escaped = DOUBLE_QUOTE_PATTERN.matcher(escaped).replaceAll("\\\\\"");
        }
        return escaped;
    }