Is SQL escaping enough to prevent injection?

No. Always use parameterised queries. Escaping here is for writing literals by hand, not for handling user input.

Is my data sent to a server?

No. Everything is processed in your browser, which matters when the input is a production payload, token or query. Nothing is uploaded, logged or stored.

String Escape and Unescape - Free Online Tool

JavaScript is turned off. InspireTools processes files in your browser, so the tools need JavaScript to run.

Escape or unescape strings for JSON, JavaScript, HTML, SQL, regex, shell and CSV.