Escape / Unescape Strings
One tool to escape or unescape strings for JSON, JavaScript, HTML, XML, URL components, regular expressions, SQL literals, CSS strings and shell arguments.
37 characters · 39 bytes (UTF-8)
0 characters · 0 bytes (UTF-8)
Runs entirely in your browser. Your data is never uploaded.
What is Escape/Unescape Tool?
A multi-format escaper: choose where the text is going (a JSON string, JavaScript string, HTML, XML, URL component, regular expression, SQL string literal, CSS string or shell argument) and get the correctly escaped form – or reverse it.
How to use Escape/Unescape Tool
- Choose Escape or Unescape.
- Pick the Format.
- Type or paste into Input; the result appears in Output.
- Use Use as input to check that unescaping gives back the original.
Example
He said "hi" C:\temp
He said \"hi\" C:\\temp
JSON format, Escape mode.
When to use Escape/Unescape Tool
Use it for quick conversions while coding or debugging. For SQL, prefer parameterised queries over escaping in applications; the SQL format follows the ANSI standard ('') and does not handle MySQL backslash escapes.
How Escape/Unescape Tool works
Each format uses its own rules: JSON uses JSON.stringify rules (\", \\, \n, \u001f); JavaScript adds \'-safe escapes and \xHH; HTML escapes & < > " ' and unescapes all HTML5 entities; XML uses the five predefined entities; URL uses encodeURIComponent rules; Regex backslash-escapes . * + ? ^ $ { } ( ) | [ ] \ / -; SQL doubles single quotes (standard SQL); CSS escapes quotes, backslashes and control characters; Shell uses POSIX single quoting.
Common Use Cases
- Putting multi-line text into a JSON string
- Escaping a literal string for use in a regex
- Writing a SQL literal containing apostrophes
- Unescaping JSON strings copied from logs
FAQs
What is the difference between the JSON and JavaScript formats?
JSON only allows a fixed set of escapes and double quotes; the JavaScript format also escapes single quotes context-free and uses \xHH for control characters.
Is SQL escaping enough to prevent injection?
Doubling quotes is correct for standard SQL string literals, but parameterised queries are the reliable defence.
Does the regex format escape everything needed?
It escapes all characters that are special in JavaScript regular expressions, including / and -.