String Escaper
Escapes and unescapes strings for JSON, JavaScript, SQL, shell, CSV and regular expressions.
Escapes a piece of text so it can be pasted inside a string literal — in JSON, JavaScript, Python, Java, C#, SQL, a shell command, a CSV field or a regular expression — and unescapes it back. Each target has its own rules, and the differences between them are exactly where injection bugs live.
RFC 8259: `\" \\ \/ \b \f \n \r \t` and `\uXXXX` for the rest. No `\'`, no `\x`, no `\0`.
Text
Escaped
In
0 chars
Out
0 chars
How to use it
Pick the target language
The note under the picker says what that target actually escapes. JSON is stricter than JavaScript; a template literal has two extra characters to worry about; single-quoted shell is a different problem from double-quoted shell.
Paste the raw text
Newlines, quotes and non-ASCII are all handled. What comes out is the *inside* of the literal — you still supply the surrounding quotes.
Check "reverses cleanly"
The stat under the output unescapes the result and compares it to what you typed. If it says no, the escaping is lossy for this target and the string you paste is not the string you had.
Common questions
Does escaping make my SQL safe?
No. Escaping a literal is not the same as a parameterised query, and this tool cannot know your database’s quoting mode, its character set, or whether the value ends up somewhere a quote is not the delimiter. Use bound parameters; use this to read a query, not to build one for production.
Why does SQL mode not use backslashes?
Because standard SQL has no backslash escape — a quote is written twice. Backslash escaping is a MySQL extension, and code that assumes it is present is where a good deal of injection has come from. If you need the MySQL behaviour, you need it deliberately.
What does the `\uXXXX` target do?
It turns every non-ASCII character into a `\uXXXX` escape, surrogate pairs included. Its most useful direction is the reverse: a properties file or a log line that an ASCII-only pipeline mangled reads back as Korean when you unescape it.
Is single-quoted shell really safe for any string?
For the string itself, yes — nothing inside POSIX single quotes has meaning, and a quote is written as `'\''`. What it does not protect against is the program you are calling interpreting the argument, or a shell that is not POSIX. It is a quoting rule, not a sandbox.
Feed it from
SQL Formatter
Formats SQL with configurable keyword case, indentation and comma placement, across major dialects.
HTML Entity Encoder
Escapes and unescapes HTML entities, with named, decimal and hexadecimal output.
JSON Formatter & Validator
Pretty-prints, minifies and validates JSON, pointing at the exact line and column of a syntax error.
YAML Formatter & Validator
Re-indents YAML consistently, validates it, and flags the tab and anchor mistakes that break parsers.
Next
These accept what this tool produces, so the result can go straight in.
HTML Entity Encoder
Escapes and unescapes HTML entities, with named, decimal and hexadecimal output.
JSON Formatter & Validator
Pretty-prints, minifies and validates JSON, pointing at the exact line and column of a syntax error.
List Formatter
Turns lines into a comma list, quoted SQL IN clause, JSON array or bullet list, and back again.
SQL Formatter
Formats SQL with configurable keyword case, indentation and comma placement, across major dialects.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.