A SQL statement is a sequence of tokens: keywords, identifiers, string literals, numbers, operators and punctuation. Whitespace and comments separate tokens and otherwise carry no meaning.
01The rules that matter
Single quotes delimit string literals; a literal quote is doubled (or backslash-escaped in MySQL).
Double quotes, backticks (MySQL) or square brackets (T-SQL) delimit identifiers.
-- starts a line comment everywhere; /* */ is a block comment; MySQL also accepts #.
PostgreSQL adds dollar-quoted strings ($tag$ … $tag$) so a literal can contain anything, including quotes.
02Why dialect matters
The same characters mean different things across engines, so a validator that assumes one dialect will misread another. Selecting the dialect keeps tokenising and structural checks accurate.
Frequently asked questions
Is a backtick always an identifier?
Only in MySQL; PostgreSQL and the standard use double quotes, and T-SQL uses square brackets.
Can a string contain a semicolon?
Yes. A semicolon inside a string literal never ends a statement; only a top-level semicolon does.
A practical guide to choosing random passwords and tokens, deriving and storing password hashes, signing tokens, encrypting with authenticated modes and measuring entropy.