wsprintf(lpOut, "INSERT INTO table_log VALUES (%s)", lpIn);

'abcd', '123', 'c:\windows'

char * quoted_str;
size_t quoted_buf_size, original_str_size, bytes_out;

original_str_size = strlen(original_str);
quoted_buf_size =  2 *original_str_size+ 2 + 1 ; // twice as much for possible escapes +  2  quotes + zero-terminator
quoted_str = alloca(quoted_buf_size);
PQescapeString(quoted_str, original_str, original_str_size);
bytes_out = snprintf(query_buf, query_buf_capacity,  "INSERT INTO table_log (field1, field2) VALUES ( %d, %s )", int_param_1, quoted_str);
if( bytes_out < query_buf_max_len) {
  result = PQexec(conn, query_buf);
} else {
   error("SQL truncation attack detected!");
}

// char * paramStrings[] = {"asdf", "123", "c:\\windows"};
PQexecParams(conn, 
  "INSERT INTO table_name (field_name1, field_name2, field_name3) VALUES ($1, $2, $3)",  
    3 , NULL, paramStrings, NULL, NULL,  0 );

// OUT: в tmp_buf строка типа "INSERT INTO table_name VALUES ($1, $2 , $3)"
// IN:
//    char * tmp_buf - указатель на память достаточную для формирования строки 
//    char * table_name - имя таблицы, кот. будет вставлено
//    int    param_count - кол-во параметров
void mk_template(char * tmp_buf, char * table_name, int param_count );

// caller must free returned pointer
char * quick_and_dirty_double_backslash (char * src){
  char * dst = malloc(strlen(src) *  2  +  1 );
  size_t pos =  0 ;
  while( *src ) {
    dst[ pos++ ] = *src;
    if ( '\\' == *src )
      dst[ pos++ ] = *src;
    src++;
  }
  dst[pos] =  0 ;
  return dst;
}