diff --git a/src/ui/utils/soqlBuilder.ts b/src/ui/utils/soqlBuilder.ts
index da43838..1f137ff 100644
--- a/src/ui/utils/soqlBuilder.ts
+++ b/src/ui/utils/soqlBuilder.ts
@@ -219,6 +219,6 @@ function isNumericType(ft: SalesforceFieldType): boolean {
 }
 
 function escapeSoqlString(s: string): string {
-  return s.replace(/'/g, "\\'");
+  return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
 }
 
diff --git a/tests/unit/soqlBuilder.test.ts b/tests/unit/soqlBuilder.test.ts
index 4b4a1f5..458ff45 100644
--- a/tests/unit/soqlBuilder.test.ts
+++ b/tests/unit/soqlBuilder.test.ts
@@ -231,6 +231,11 @@ describe('formatSoqlValue', () => {
     expect(formatSoqlValue("O'Brien", 'string', '=')).toBe("'O\\'Brien'");
   });
 
+  it('escapes backslashes before quotes to prevent injection', () => {
+    expect(formatSoqlValue('C:\\data\\', 'string', '=')).toBe("'C:\\\\data\\\\'");
+    expect(formatSoqlValue("test\\' OR Name != NULL --", 'string', '=')).toBe("'test\\\\\\' OR Name != NULL --'");
+  });
+
   it('returns bare number for numeric types', () => {
     expect(formatSoqlValue('42', 'int', '=')).toBe('42');
     expect(formatSoqlValue('3.14', 'double', '>')).toBe('3.14');