# Escape and unescape strings

Escape text for a JSON or JavaScript string, a SQL string, a CSV field, a regular expression or a shell word, or undo the escaping.

https://codeknife.dev/en/escape-unescape/

## What it does

Escapes text so it can sit inside a JSON or JavaScript string, a SQL string, a CSV field, a regular expression or a shell word, and undoes the escaping. Each format escapes exactly the characters it needs and no others.

## How to use it

1. Type or paste text, or drop a text file.
2. Choose where the text is going (**JSON string**, **JavaScript string**, **SQL string**, **CSV field**, **Regular expression** or **Shell word**) and whether to **Escape** or **Unescape**.
3. Copy or download the result, or use **Use output as input** to turn it into the next input.

## Examples

Escaping `He said "it's fine"` and a line break:

JSON gives `He said \"it's fine\"\n`, SQL gives `He said "it''s fine"`, and the shell gives `'He said "it'\''s fine"'`.

## Good to know

- JSON and JavaScript escape the backslash, the quote that wraps the string, line breaks and control characters. Unescaping reads `\n`, `\t`, `\uXXXX` and the like; JavaScript also reads `\xHH` and `\u{…}`.
- SQL doubles the single quote. This is right for a literal you write by hand; for code, use bound parameters instead.
- A CSV field is wrapped in quotes only when it holds a comma, a quote or a line break, and quotes inside are doubled.
- A shell word is wrapped in single quotes, and a single quote inside is written as `'\''`, so nothing in it is expanded.

## Why does each format escape differently?

Every syntax has its own special characters. A JSON string needs quotes, backslashes and control characters escaped. A SQL string only needs the single quote doubled. A CSV field is wrapped in quotes when it holds a comma, quote or line break. A regular expression escapes its operators, and a shell word is wrapped in single quotes so nothing in it is expanded.

## Frequently asked questions

### Is escaping enough to stop SQL injection?

No. Doubling quotes is what this tool shows, and it is right for a literal in a query you write by hand, but it is not a defence for code. Pass values as bound parameters instead, so they are never part of the SQL text.

### What is the difference between a JSON and a JavaScript string?

JSON allows only a few escapes and always uses double quotes. JavaScript also allows single quotes, \x41, and escapes in either quote style. Unescaping as JSON therefore refuses sequences JavaScript would accept.

### Does this tool send my text anywhere?

No. Everything happens in your browser. What you type is never sent to our servers.