How to use the string escaper
- Paste or type into Text. Line breaks and tabs count.
- Choose the Context: JSON string, JavaScript string, HTML, XML, SQL string literal, Regular expression, Shell (POSIX single quotes), CSV field or URL component.
- Choose Mode: Escape to make the text safe for that context, or Unescape to turn an escaped value back into plain text.
- Copy the result. JSON and JavaScript results come without the outer quotes; SQL, shell and CSV results include them where the rules need them.
What it does and when to use it
Every language has characters that end a string early or change its meaning: a quote in JSON, a $ in a regex, a ' in SQL or shell, a < in HTML. Escaping them by hand is slow and error-prone. This tool handles the rule set for the target you pick. Use it to put a Windows path or a multi-line message into a JSON config, build a regex that matches a literal price, add a name such as O’Neil to an SQL seed file, or pass a message with spaces and quotes to a shell script.
Related tools cover single jobs in more depth: JSON String Escape for JSON only, the JS Regex Escaper for patterns, and the HTML Entities Ref to look up an entity name.
How it works
| Context | Escape rule |
|---|---|
| JSON | " and \ get a backslash; control characters become \n, \t or \uXXXX (RFC 8259) |
| JavaScript | backslash escapes for a single-quoted ECMAScript string |
| HTML / XML | & < > " ' become entities (' in HTML, ' in XML) |
| SQL | ' doubled, whole value wrapped in '…' |
| Regex | \ ^ $ . * + ? ( ) [ ] { } | / - get a backslash |
| Shell | wrapped in '…', each ' becomes '\'' |
| CSV | quoted and " doubled when the field has , " a line break or edge spaces (RFC 4180) |
| URL | encodeURIComponent; unescape also reads + as a space |
Everything runs in your browser.
Worked examples
A literal price in a regex. Text price: $9.99 (USD)?, context Regular expression:
price: \$9\.99 \(USD\)\?A JavaScript string. Text with a line break, a tab and double quotes gives Line 1\nTab\there "quoted", ready to paste between single quotes.
An SQL literal. O'Neil becomes 'O''Neil'.
A URL component. a&b=c d/é becomes a%26b%3Dc%20d%2F%C3%A9. A broken escape such as 100% in Unescape mode returns an error instead of a guess.
Limits and tips
- Pick the context of the innermost layer first. A JSON value inside a shell command needs JSON escaping, then shell escaping.
- To build a whole query string at once, use the Query String Builder.
Frequently asked questions
Is SQL escaping enough to stop SQL injection?
Why does the JavaScript mode leave double quotes alone?
Does HTML escaping make text safe everywhere in a page?
Which shell does the Shell mode target?
Does unescaping HTML know every named entity?
How do we know nothing is uploaded? Test it yourself on the privacy proof page.