String Escaper
Escape or unescape text for JSON, JS, HTML, XML, URL, regex, SQL, CSV and shell.
About this tool
Choose a format and a direction, then type or paste. The escaped or unescaped text appears immediately with a character count. Switching direction feeds the output back in, so you can confirm that a value round-trips cleanly. The formats are JSON string, JavaScript (also suitable for Java and C), HTML, XML, URL component, regular expression, SQL string literal, CSV field and POSIX shell.
Why and how text is escaped
Escaping lets text sit safely inside another format without breaking it or changing its meaning. In a JSON or JavaScript string, quotes, backslashes and line breaks must be written as \", \\ and \n. In HTML and XML, <, >, & and quotes become entities, which is also the first line of defence against cross-site scripting when inserting user text. URLs percent-encode spaces and symbols, so "a b&c" becomes a%20b%26c. Regular expressions need a backslash before special characters such as . * + ? ( ) [ ] so they match literally. SQL string literals double the apostrophe, so O'Brien becomes O''Brien, and CSV wraps fields containing commas, quotes or line breaks in double quotes, doubling any quotes inside. POSIX shell wraps the whole argument in single quotes. Honest limits: in real code, use parameterised queries instead of escaping SQL by hand, and use your framework's templating for HTML. HTML escaping protects element content and quoted attributes, not URLs, scripts or styles, and the shell mode is for sh and bash, not Windows cmd or PowerShell. The HTML entities converter, the URL encoder and the regex tester go deeper on single formats. URL encoding explained: why spaces become %20 (or +), and what has to be escaped explains percent-encoding.
Frequently asked questions
How do I escape quotes in a JSON string?
Put a backslash before each double quote: ". Backslashes themselves become \ and line breaks become .
How do I escape an apostrophe in SQL?
Double it: 'O''Brien'. In application code, use parameterised queries instead of escaping by hand.
What characters need escaping in a regular expression?
The special characters . * + ? ^ $ { } ( ) | [ ] \ and, inside slashes, /. Escape them with a backslash to match them literally.
Is my text saved?
No. Everything runs in your browser and nothing is stored or sent.