MySQL 5.7 C API Developer Guide
unsigned long
mysql_hex_string(char *to,
                 const char *from,
                 unsigned long length)
This function creates a legal SQL string for use in an SQL statement. See String Literals.
          The string in the from argument is encoded
          in hexadecimal format, with each character encoded as two
          hexadecimal digits. The result is placed in the
          to argument, followed by a terminating null
          byte.
        
          The string pointed to by from must be
          length bytes long. You must allocate the
          to buffer to be at least
          length*2+1 bytes long. When
          mysql_hex_string() returns,
          the contents of to is a null-terminated
          string. The return value is the length of the encoded string,
          not including the terminating null byte.
        
          The return value can be placed into an SQL statement using
          either X'
          or value'0x
          format. However, the return value does not include the
          valueX'...' or 0x. The caller
          must supply whichever of those is desired.
        
char query[1000],*end;
end = strmov(query,"INSERT INTO test_table values(");
end = strmov(end,"X'");
end += mysql_hex_string(end,"What is this",12);
end = strmov(end,"',X'");
end += mysql_hex_string(end,"binary data: \0\r\n",16);
end = strmov(end,"')");
if (mysql_real_query(&mysql,query,(unsigned int) (end - query)))
{
   fprintf(stderr, "Failed to insert row, Error: %s\n",
           mysql_error(&mysql));
}
          The strmov() function used in the example
          is included in the libmysqlclient library
          and works like strcpy() but returns a
          pointer to the terminating null of the first parameter.
        
          The length of the encoded string that is placed into
          to, not including the terminating null
          character.