diff --git a/source/client/src/clientSml.c b/source/client/src/clientSml.c
index c972575e59..065f2e1fdb 100644
--- a/source/client/src/clientSml.c
+++ b/source/client/src/clientSml.c
@@ -1316,9 +1316,15 @@ static int32_t smlInsertData(SSmlHandle *info) {
     uDebug("SML:0x%" PRIx64 " smlInsertData table:%s, uid:%" PRIu64 ", format:%d", info->id, pName.tname,
            tableData->uid, info->dataFormat);
 
+    int   measureLen = tableData->sTableNameLen;
+    char* measure = (char*)taosMemoryMalloc(tableData->sTableNameLen);
+    memcpy(measure, tableData->sTableName, tableData->sTableNameLen);
+    PROCESS_SLASH_IN_MEASUREMENT(measure, measureLen);
+
     code = smlBindData(info->pQuery, info->dataFormat, tableData->tags, (*pMeta)->cols, tableData->cols,
-                       (*pMeta)->tableMeta, tableData->childTableName, tableData->sTableName, tableData->sTableNameLen,
+                       (*pMeta)->tableMeta, tableData->childTableName, measure, measureLen,
                        info->ttl, info->msgBuf.buf, info->msgBuf.len);
+    taosMemoryFree(measure);
     if (code != TSDB_CODE_SUCCESS) {
       uError("SML:0x%" PRIx64 " smlBindData failed", info->id);
       return code;
diff --git a/source/client/src/clientSmlLine.c b/source/client/src/clientSmlLine.c
index 6260bcb234..1732473c11 100644
--- a/source/client/src/clientSmlLine.c
+++ b/source/client/src/clientSmlLine.c
@@ -155,7 +155,7 @@ static int32_t smlParseTagKv(SSmlHandle *info, char **sql, char *sqlEnd, SSmlLin
         char* measure = currElement->measure;
         int   measureLen = currElement->measureLen;
         if(currElement->measureEscaped){
-          measure = taosMemoryMalloc(currElement->measureLen);
+          measure = (char*)taosMemoryMalloc(currElement->measureLen);
           memcpy(measure, currElement->measure, currElement->measureLen);
           PROCESS_SLASH_IN_MEASUREMENT(measure, measureLen);
         }
@@ -230,7 +230,7 @@ static int32_t smlParseTagKv(SSmlHandle *info, char **sql, char *sqlEnd, SSmlLin
         return TSDB_CODE_SML_INVALID_DATA;
       }
 
-      if (IS_SLASH_LETTER_IN_TAG_FIELD_KEY(value)) {
+      if (IS_SLASH_LETTER_IN_TAG_FIELD_KEY(*sql)) {
         valueLenEscaped++;
         valueEscaped = true;
       }
@@ -349,7 +349,7 @@ static int32_t smlParseColKv(SSmlHandle *info, char **sql, char *sqlEnd, SSmlLin
         char* measure = currElement->measure;
         int   measureLen = currElement->measureLen;
         if(currElement->measureEscaped){
-          measure = taosMemoryMalloc(currElement->measureLen);
+          measure = (char*)taosMemoryMalloc(currElement->measureLen);
           memcpy(measure, currElement->measure, currElement->measureLen);
           PROCESS_SLASH_IN_MEASUREMENT(measure, measureLen);
         }
@@ -460,9 +460,9 @@ static int32_t smlParseColKv(SSmlHandle *info, char **sql, char *sqlEnd, SSmlLin
     }
 
     if (keyEscaped){
-      char *tmp = (char*)taosMemoryMalloc(keyLen);
-      memcpy(tmp, key, keyLen);
-      PROCESS_SLASH_IN_TAG_FIELD_KEY(tmp, keyLen);
+      char *tmp = (char*)taosMemoryMalloc(kv.keyLen);
+      memcpy(tmp, key, kv.keyLen);
+      PROCESS_SLASH_IN_TAG_FIELD_KEY(tmp, kv.keyLen);
       kv.key = tmp;
       kv.keyEscaped = keyEscaped;
     }
diff --git a/utils/test/c/sml_test.c b/utils/test/c/sml_test.c
index 515da64081..54fa594e39 100644
--- a/utils/test/c/sml_test.c
+++ b/utils/test/c/sml_test.c
@@ -906,7 +906,7 @@ int sml_escape_Test() {
 
   const char *sql[] = {
       "d\\,i=\\ s\\k\",dev\"i\\,\\=\\ ce=s\"i\\,\\=\\ dc inode\"i\\,\\=\\ s_used=176059i,total=1076048383523889174i 1661943960000000000",
-      "d\\,i=\\ s\\k\",dev\"i\\,\\=\\ ce=s\"i\\,\\=\\ dc inode\"i\\,\\=\\ s_free=\"\\\"id,= ei\\\\\\f\" 1661943960000000000",
+      "d\\,i=\\ s\\k\",dev\"i\\,\\=\\ ce=s\"i\\,\\=\\ dc inode\"i\\,\\=\\ s_f\\\\ree=\"\\\"id,= ei\\\\\\f\" 1661943960000000000",
   };
   pRes = taos_schemaless_insert(taos, (char **)sql, sizeof(sql) / sizeof(sql[0]), TSDB_SML_LINE_PROTOCOL, 0);
   printf("%s result:%s, rows:%d\n", __FUNCTION__, taos_errstr(pRes), taos_affected_rows(pRes));
@@ -924,6 +924,9 @@ int sml_escape_Test() {
   int         numFields = taos_num_fields(pRes);
   TAOS_FIELD *fields = taos_fetch_fields(pRes);
   ASSERT(numFields == 5);
+  ASSERT(strcmp(fields[1].name, "inode\"i,= s_used") == 0);
+  ASSERT(strcmp(fields[2].name, "total") == 0);
+  ASSERT(strcmp(fields[3].name, "inode\"i,= s_f\\\\ree") == 0);
   ASSERT(strcmp(fields[4].name, "dev\"i,= ce") == 0);
 
   TAOS_ROW row = NULL;
@@ -932,13 +935,12 @@ int sml_escape_Test() {
     int64_t ts = *(int64_t *)row[0];
     int64_t used = *(int64_t *)row[1];
     int64_t total = *(int64_t *)row[2];
-    int64_t freed = *(int64_t *)row[3];
 
     if (rowIndex == 0) {
       ASSERT(ts == 1661943960000);
       ASSERT(used == 176059);
       ASSERT(total == 1076048383523889174);
-      ASSERT(freed == 66932805);
+      ASSERT(strcmp(row[3], "\"id,= ei\\\\f") == 0);
       ASSERT(strcmp(row[4], "s\"i,= dc") == 0);
 
     }
@@ -1300,6 +1302,7 @@ int main(int argc, char *argv[]) {
 
   int ret = 0;
   ret = sml_escape_Test();
+  ASSERT(!ret);
   ret = sml_ts3116_Test();
   ASSERT(!ret);
   ret = sml_ts2385_Test();    // this test case need config sml table name using ./sml_test config_file