Some characters have a special meaning in code and markup. A quote can end a string, an ampersand can start an entity, and a space can split a command in two. Escaping replaces those characters with a safe form so the text is read as plain text. The String Escaper above does this for 12 formats, shows only the options that matter for the format you pick, and checks its own work with a round-trip test. It runs in your browser, so your text is never uploaded.
Table of Contents
What Is String Escaping?
When you put text inside a JSON value, a JavaScript string, an HTML page or a URL, some characters must be written differently. For example, a double quote inside a JSON string becomes \", and a space in a URL becomes %20. If you skip this step, you get syntax errors, broken pages, or in the worst case a security hole. Each format has its own rules, so the right escaping for JSON is wrong for SQL or for a shell command.
How to Use the String Escaper
- Paste your text. Type or paste it into the box, or click Try Sample.
- Choose the format. Pick where the text will be used, such as JSON, HTML or Shell. The options below the box change to match the format.
- Choose how to apply it. Escape the whole text as one string, or escape each line separately. The second choice is handy for lists.
- Set the options. For example, choose the quote style, or whether to add the surrounding quotes.
- Read the check. The tool unescapes its own result and tells you whether you get your original text back.
- Copy or download. Click Copy Result or Download .txt.
The Same Text in 12 Formats
This is the result for the text It's a "test" & 50% <b>é</b>:
| Format | Result |
|---|---|
| JSON string | It's a \"test\" & 50% <b>é</b> |
| JavaScript (single quotes) | It\'s a "test" & 50% <b>é</b> |
| Python (double quotes) | It's a \"test\" & 50% <b>é</b> |
| HTML attribute | It's a "test" & 50% <b>é</b> |
| XML attribute | It's a "test" & 50% <b>é</b> |
| URL (component) | It's%20a%20%22test%22%20%26%2050%25%20%3Cb%3E%C3%A9%3C%2Fb%3E |
| SQL (standard) | It''s a "test" & 50% <b>é</b> |
| SQL (MySQL) | It\'s a \"test\" & 50% <b>é</b> |
| Shell (single quotes) | 'It'\''s a "test" & 50% <b>é</b>' |
| CSV value | "It's a ""test"" & 50% <b>é</b>" |
| Markdown | It's a "test" & 50% \<b\>é\</b\> |
| Unicode escapes | It's a "test" & 50% <b>\u00e9</b> |
Notice how different the results are. Only the formats that treat a character as special change it, which is why you must always pick the format of the place where the text will be used.
Options Explained
- Add surrounding quotes (JSON, JavaScript, Python, SQL) wraps the result in quotes so you can paste it straight into code.
- Quote style (JavaScript, Python) chooses double quotes, single quotes or, for JavaScript, a template literal. Only the chosen quote is escaped.
- Escape non-ASCII characters (JSON, JavaScript, Python, HTML, XML) writes letters such as é as
\u00e9oré. Use it when the destination cannot handle UTF-8. - HTML-safe (JSON) also escapes
<,>and&, so JSON can sit safely inside an HTML page. - Context (HTML, XML) chooses text content, where only
&,<and>are escaped, or an attribute value, where quotes are escaped too. - Method (URL) chooses component encoding for query values, full URL encoding that keeps
:/?#, or form encoding with+for spaces. - Database (SQL) chooses standard SQL, which doubles the single quote, or MySQL, which uses backslashes.
- Quoting style (Shell) chooses single quotes, which are the safest, double quotes, or the ANSI-C
$'...'form. - Also escape - and / (Regex), Delimiter and Always add quotes (CSV), and the Style of Unicode escapes complete the list.
Escaping and Security
Escaping is a building block of safe code, but the correct tool depends on the risk:
- SQL injection. Do not build queries by joining strings, even with escaping. Use parameterized queries. See the OWASP SQL Injection Prevention Cheat Sheet.
- Cross-site scripting (XSS). Escape output for the exact place it appears: HTML text, an attribute, JavaScript or a URL. See the OWASP XSS Prevention Cheat Sheet.
- Shell commands. Avoid building commands from outside input. If you must, single-quote the value.
Limitations to Know
- MySQL mode depends on the server. Backslash escapes are not used if the server runs with the
NO_BACKSLASH_ESCAPESmode. Standard SQL mode works for PostgreSQL, SQLite, SQL Server and Oracle string literals. - NUL characters. A NUL character cannot live in a shell string, and many databases reject it. The tool warns you.
- Control characters in XML. XML 1.0 does not allow most control characters, even as references. The tool warns you.
- Broken Unicode. A lone surrogate character cannot be URL-encoded. The tool tells you.
- Other formats. PHP, Java, C#, YAML and others are not included, although JSON and JavaScript rules are close to several of them.
Frequently Asked Questions
Is the String Escaper free, and is my text uploaded?
It is free and needs no signup. The text is escaped in your browser and is never sent to a server.
What is the difference between escaping and encoding?
The words are often used for the same idea. Escaping usually means adding a backslash or an entity to a few special characters, while encoding, such as URL or Base64 encoding, rewrites the whole text. This tool covers both kinds, as each format defines them.
Which format should I choose for text inside an HTML attribute?
Choose HTML and set the context to Attribute value. This escapes quotes as well as the ampersand and the angle brackets.
Why does the shell result use '\'' for a single quote?
A single-quoted shell string cannot contain a single quote. The pattern closes the quote, adds an escaped quote, and opens the quote again. It is the standard safe way.
What does the round-trip check mean?
The tool unescapes its own result and compares it with your input. If they match, the escaped text carries exactly the same meaning. If they differ, test it carefully before you use it.
Can I escape many strings at once?
Yes. Put one string per line and choose Each line separately. Every line is escaped on its own, and the result keeps the same line order.
Final Thoughts
Escaping is simple when you know the rules of the format, and painful when you guess. Pick the format of the destination, read the round-trip check, and test the result in the place where it will be used. For anything that touches a database or a web page in a real application, rely on your framework's built-in protection as well.