String escape and unescape
Pick where the text is going and whether to escape or unescape it. Quotes, backslashes, line breaks and special characters are handled for you, one format at a time.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Choose Escape or Unescape and the format.
- Paste the text. The result appears immediately; copy it with one click.
| Format |
Escaped characters |
| JSON string |
" \ and control characters (line break → \n, tab → \t, others → \uXXXX) |
| JavaScript string |
the same plus ', ` and ${ |
| HTML |
& < > " ' become entities |
| URL component |
everything except letters, digits and - _ . ! ~ * ' ( ) becomes %XX in UTF-8 |
| CSV field |
" is doubled, and the field is quoted when needed |
| SQL |
' becomes '' |
| Regular expression |
`. * + ? ^ $ { } ( ) |
Unescaping
JSON unescape accepts the text with or without surrounding double quotes and tolerates real line breaks. JavaScript unescape understands \n, \xNN, \uNNNN, \u{…} and line continuations. Regex unescape removes backslashes from the characters above; other escapes such as \d are left alone.
Tips
Escape once, at the last moment before the text goes into its destination. Escaping twice produces doubled backslashes or &amp;.
Frequently asked questions
What is the difference between the JSON and JavaScript formats?
JSON escapes only the double quote, the backslash and control characters. JavaScript also escapes single quotes and backticks, and writes ${ as \${, so the result is safe inside any kind of JavaScript string, including template literals.
Does the quoted result include the surrounding quotes?
No. You get only the content to place between your own quotes. For CSV the field is wrapped in quotes only when it needs them, that is when it has a comma, semicolon, quote, line break or edge spaces.
Is SQL escaping enough to prevent SQL injection?
No. Doubling single quotes is the standard escape for a string literal, but the right defence is parameterized queries. Use this for one-off scripts, not for building queries from user input.
Which HTML entities can it unescape?
All numeric entities (é and é) and the common named ones: amp, lt, gt, quot, apos, nbsp, copy, reg, trade, euro, quotes, dashes and more. A name outside this list is left as it is.
Why does URL decoding keep + as +?
This tool uses percent-encoding as in encodeURIComponent and decodeURIComponent, where a space is %20. Only HTML form data uses + for a space.