String Escape/Unescape

How to escape or unescape a string

1. Pick the target in Format: JSON string, JavaScript string, JavaScript template literal, SQL string literal, CSV field, HTML attribute value, regular expression or URL component.
2. Type or paste your text in the input box.
3. Click Escape to turn plain text into a safe literal, or Unescape to turn a literal back into plain text. The result updates as you type, in the direction you last chose.
4. Adjust the options shown for the format: Add surrounding quotes, Escape non-ASCII characters or Spaces as + (form data).
5. Click Copy, or Use output as input to reverse the operation and check the round trip.

The character counts before and after are shown under the buttons. Everything runs in your browser; nothing is uploaded.

What each format does

• JSON string: escapes ", \ and control characters (\n, \t, \u0000…), exactly like JSON.stringify. With Escape non-ASCII characters, every character above U+007E becomes \uXXXX (emoji become a surrogate pair such as \ud83d\ude00). Unescaping accepts the text with or without its double quotes, and tolerates raw line breaks.
• JavaScript string (‘…’): escapes the backslash, the single quote, line breaks and control characters, plus U+2028 and U+2029, which break older engines. Unescaping understands \x41, \u0041, \u{1F600}, legacy octal escapes such as \101 and line continuations.
• JavaScript template literal (`…`): escapes backticks, backslashes and ${ so no expression is evaluated; line breaks and tabs stay as they are, since template literals allow them.
• SQL string literal (‘…’): doubles single quotes (O'Brien → 'O''Brien'), as in standard SQL. Unescaping refuses a quote that is not doubled. Backslashes are left alone: MySQL in its default mode also treats \ as an escape character, so check your database’s rules.
• CSV field (RFC 4180): wraps the field in double quotes and doubles inner quotes when it contains a comma, semicolon, tab, quote, line break or leading/trailing space. Add surrounding quotes forces the quotes.
• HTML attribute value: replaces &, <, >, " and ' with entities, which is safe in both single- and double-quoted attributes. Unescaping decodes numeric references and &, <, >, ", ' and  .
• Regular expression (literal text): backslash-escapes . * + ? ^ $ { } ( ) | [ ] \ /, plus line breaks and tabs, so the pattern matches the text literally. The result is valid with or without the u flag.
• URL component (percent-encoding): works like encodeURIComponent, encoding everything except letters, digits and - _ . ! ~ * ' ( ) as UTF-8 bytes. Spaces as + (form data) uses the application/x-www-form-urlencoded convention.

Escaping is not a security boundary for SQL

When you choose SQL, the tool shows a reminder, and it deserves repeating: the real fix for SQL injection is a parameterized query (prepared statement), where the value is sent separately from the SQL text. Escaping by hand is fragile: it depends on the database, the connection character set and settings such as MySQL’s backslash handling. Use this output to read logs, write fixtures or debug a query, never to build queries from user input.

For CSV, the tool also warns when a value starts with =, +, - or @: a spreadsheet may run it as a formula (CSV injection). Quoting does not prevent that; prefixing the value with an apostrophe or a space is the usual mitigation.