String Escape / Unescape
Make text safe to drop into code, whether that is JSON, SQL or a shell command.
Your result will appear hereJSON uses backslash escapes and \u sequences for control characters, per RFC 8259.
Processed entirely in your browser — nothing is sent to a server.
About this tool
String escape / unescape prepares text to be dropped safely into code, whether the destination is JSON, JavaScript, SQL, a shell command, a regular expression or a CSV file.
The reason it asks where the text is going is that the rules genuinely differ. SQL doubles the quote; JSON backslashes it; inside shell single quotes nothing is special at all. A tool that escapes everything the same way is wrong in at least one of those cases.
Getting it wrong is not cosmetic. An unescaped quote in a SQL literal is an injection, and a single unescaped . in a regular expression matches any character instead of a literal dot.
JavaScript mode additionally breaks up </script>, because text containing it will close an inline script tag early and spill the rest of the page as HTML — one of the most common XSS vectors there is. Everything runs in your browser; your text is never uploaded.
How to use
- 1Choose Escape or Unescape
- 2Choose where the text is going: JSON, SQL, a shell command and so on
- 3Paste your text — the result appears instantly
- 4Copy the "ready to paste" box if you want the surrounding quotes included
Frequently asked questions
- Why does SQL double the quote instead of using a backslash?
- The SQL standard escapes a single quote by repeating it (O''Brien). Backslash is not a standard escape character, so using one is either rejected or behaves differently depending on the database.
- Does escaping actually prevent SQL injection?
- It helps, but it is not the right primary defence. Prepared statements (parameterized queries) separate data from the statement entirely and are far safer. This tool is for preparing constants and for seeing what a properly escaped value looks like.
- Why does JavaScript mode break up </script>?
- If the text contains </script> and you paste it inside a script tag, the browser closes the tag right there and the rest spills out as HTML. It is one of the most common XSS vectors.
- Why does shell mode barely change anything?
- Inside shell single quotes no character is special — not $, not a backtick, not an asterisk. Only the single quote itself needs the end-escape-restart trick.
- Does Thai text need escaping?
- No. Thai characters are not special in any of these formats, so they pass through unchanged in every mode.