String Escape / Unescape
Escape or unescape text for JSON, JavaScript, Python, HTML, URL, CSV, regex, SQL and shell
Escapes quotes, backslashes, control characters. Result is without the outer quotes.
About String Escape / Unescape
Escapes text so it can sit safely inside a JSON, JavaScript, Python, HTML, XML, URL, CSV, regular-expression, SQL or shell string, and reverses the process.
Paste your text, choose the format and direction. The result appears at once. The escaped text does not include the surrounding quotes (except CSV and shell, where the quotes are part of the escaping).
Escaping SQL by hand is only for quick checks. In real code always use query parameters, because they are the reliable defence against SQL injection.
- What is the difference between escaping for JSON and for JavaScript?
- JSON needs double quotes, backslashes and control characters escaped. JavaScript strings can also be single-quoted or template literals, so this option escapes single quotes, backticks and the ${ marker as well.
- Why are the outer quotes missing?
- For JSON, JavaScript and Python only the inside of the string is escaped so you can place it between whichever quotes you use. CSV and shell escaping include their quotes because they are part of the rule.
- Is the SQL escape enough to stop SQL injection?
- No. Doubling single quotes is a quick manual aid. In real programs use parameterised queries or prepared statements, which are the dependable defence.
- What does the URL option encode?
- It uses percent-encoding for everything except letters, digits and - _ . ! ~ * ' ( ), the same as encodeURIComponent. That is right for a single query value, not for a whole address.
- Why did unescaping give an error?
- The text has an incomplete or invalid sequence, such as a \u followed by fewer than four hex digits, or a percent code like %E0%A4%A that is cut short. Fix or complete the sequence and try again.
How to use String Escape / Unescape
Choose the format (JSON, JavaScript, Python, HTML, XML, URL, CSV, regular expression, SQL or shell) and whether to escape or unescape, then type or paste the text. The result appears at once. A one-line note under the format explains exactly what is changed. Copy the result with the button.
When to use it
Use it when you need to put text containing quotes, backslashes, line breaks or special characters inside a string in code, a JSON file, a CSV cell, an HTML page, a search pattern or a command line, or when you have an escaped string and want to read the original.
When not to use it
It is a convenience for single strings, not a security control. Do not build SQL or shell commands from user input with it; use parameterised queries and proper argument passing. It does not handle whole files or code blocks with their own quoting rules.
Tips for best results
For JSON and JavaScript the escaped result can go straight between double quotes (JavaScript also covers single quotes and backticks). For a regular expression, escape text you want matched literally. For SQL, the quote-doubling shown is only for quick checks; real programs should use query parameters.
Limitations
Output for JSON, JavaScript and Python does not include the outer quotes, and CSV and shell add their own. HTML unescape reads the common named entities and numeric ones, and leaves unknown names as they are. Unescaping stops with a message for incomplete sequences such as a truncated \u escape or an invalid percent code.
Privacy
The conversion is done in your browser with plain string functions. The text is not uploaded, saved or logged.
More from Security & Developer: