Escape and unescape strings
Escape text for a JSON or JavaScript string, a SQL string, a CSV field, a regular expression or a shell word, or undo the escaping.
Code examples
Copy and paste these into your own project. Each one uses only the language's standard library, so there is nothing to install.
const text = 'He said "hi"'
console.log(JSON.stringify(text).slice(1, -1))What it does
Escapes text so it can sit inside a JSON or JavaScript string, a SQL string, a CSV field, a regular expression or a shell word, and undoes the escaping. Each format escapes exactly the characters it needs and no others.
How to use it
- Type or paste text, or drop a text file.
- Choose where the text is going (JSON string, JavaScript string, SQL string, CSV field, Regular expression or Shell word) and whether to Escape or Unescape.
- Copy or download the result, or use Use output as input to turn it into the next input.
Examples
Escaping He said "it's fine" and a line break:
JSON gives He said \"it's fine\"\n, SQL gives He said "it''s fine", and the shell gives 'He said "it'\''s fine"'.
Good to know
- JSON and JavaScript escape the backslash, the quote that wraps the string, line breaks and control characters. Unescaping reads
\n,\t,\uXXXXand the like; JavaScript also reads\xHHand\u{…}. - SQL doubles the single quote. This is right for a literal you write by hand; for code, use bound parameters instead.
- A CSV field is wrapped in quotes only when it holds a comma, a quote or a line break, and quotes inside are doubled.
- A shell word is wrapped in single quotes, and a single quote inside is written as
'\'', so nothing in it is expanded.
Why does each format escape differently?
Every syntax has its own special characters. A JSON string needs quotes, backslashes and control characters escaped. A SQL string only needs the single quote doubled. A CSV field is wrapped in quotes when it holds a comma, quote or line break. A regular expression escapes its operators, and a shell word is wrapped in single quotes so nothing in it is expanded.
Frequently asked questions
Is escaping enough to stop SQL injection?
No. Doubling quotes is what this tool shows, and it is right for a literal in a query you write by hand, but it is not a defence for code. Pass values as bound parameters instead, so they are never part of the SQL text.
What is the difference between a JSON and a JavaScript string?
JSON allows only a few escapes and always uses double quotes. JavaScript also allows single quotes, \x41, and escapes in either quote style. Unescaping as JSON therefore refuses sequences JavaScript would accept.
Does this tool send my text anywhere?
No. Everything happens in your browser. What you type is never sent to our servers.