How to pass an asterisk into bash heredoc?

You could prevent parameter expansion, command substitution, and arithmetic expansion in a here-document by quoting the delimiter string:

... <<\EndOfMySQL
...
EndOfMySQL

Escaping the single character will also prevent the expansions listed above.

Edit: Note that the lines of the here-doc are no subject to filename generation (globbing)!

I suppose that the problem in this case is that you didn't quote the variable passed to mysql:

echo $query | mysql database

should be:

echo "$query" | mysql database

or better yet:

printf '%s\n' "$query" | mysql database

Why don't you use:

query='INSERT into tmp_table
SELECT * FROM table;'
printf '%s\n' "$query" | mysql

or (if your shell supports here-strings, recent versions of bash support them):

mysql <<< "$query"

To prevent * and other glob charcters from expanding. disable globbing –use set -f before your Here Document

Escaping any of the characters of the delimiter of Here Document does mean that No parameter expansion, command substitution, arithmetic expansion, or pathname expansion is performed – However, pathname expansion has a caveat !

From man bash

• Pathname Expansion — After word splitting, *unless the -f option has been set, bash scans each word for the characters *, ?, and [. If one of these characters appears, then the word is regarded as a pattern, and replaced with an alphabetically sorted list of file names matching the pattern.

• Shell Builtin Commnds — set -f – Disable pathname expansion.

From help set

• -f – Disable file name generation (globbing).