String Escaper / Unescaper

Escape Sequences: Why They Exist and How to Get Them Right

Every text format has special characters, quotes that delimit strings, backslashes that introduce escapes, angle brackets that mark tags. To include a literal version of one of those special characters in your data, you need to escape it: rewrite it in a form the parser will recognize as "literal, not syntax." Different formats use different escape conventions. Mixing them up causes bugs ranging from "my JSON won't parse" to "my XSS filter doesn't work." This tool maps text between formats and back.

JSON

JSON strings are double-quoted. The escape rules:

What's NOT in JSON:

• \' (single quote escape).
• \x41 (hex byte escape).
• \0 (null shortcut).
• \v (vertical tab, not a JSON escape; use \u000B).

Always required: control characters (U+0000 to U+001F) must be escaped. Newline literal inside a JSON string = invalid JSON.

Code points outside the BMP (e.g., emoji): JSON uses surrogate pairs. 😀 = U+1F600 = \uD83D\uDE00. Modern parsers accept the literal character too.

Practical advice: use JSON.stringify to generate JSON. Hand-writing escapes is bug-prone. JSON.stringify('hello "world"\n') → "hello \"world\"\n".

JavaScript

JS string literals (single, double, or template):

JS is more permissive than JSON. Notable: template literals interpolate ${...}, escape with \${. To inline JSON inside a <script> block, also escape </ → <\/ to prevent the HTML parser breaking out of the script tag.

HTML

HTML escapes are entities: &name; or &#code;.

Minimum required for element content:

Additionally required for attribute values (depending on quoting):

Common named entities:

•  , non-breaking space.
• ©, ©.
• ™, ™.
• …, ….
• — / –,, / –.

Numeric character references: &#XX; (decimal) or &#xXX; (hex). 😀 = 😀.

Critical security note: HTML escaping for element content is NOT enough if you're inserting into:

• <script> tags, needs JS string escaping.
• <style> tags, needs CSS escaping.
• URL attributes (href, src), needs URL encoding + JavaScript URL scheme validation.
• Event handlers (onclick), needs JS escaping.

The OWASP XSS cheat sheet enumerates contextual escape rules. Use framework escaping (React's JSX auto-escapes, Vue's {{ }} auto-escapes, etc.) instead of hand-rolling.

XML

Like HTML but stricter and a smaller required set:

XML has only 5 predefined entities. Anything else ( , ©) must be declared in a DTD or written as numeric reference.

CDATA sections wrap unescaped content: <![CDATA[ <raw> & content ]]>. Inside CDATA, only ]]> is special, escape with ]]]]><![CDATA[> (yes, that's the official way).

SQL

The hard one. Standard SQL says: double the quote.

But databases vary:

MySQL (default):

• Both quote doubling AND backslash escapes ('O\'Brien').
• Backslash escapes: \n, \t, \\, \', \", \0, \Z (Ctrl-Z), \b, \r.
• NO_BACKSLASH_ESCAPES mode disables the backslash form.

PostgreSQL:

• Standard quote doubling.
• Backslash escapes only inside E'...' strings (e.g., E'O\'Brien').
• Otherwise, backslash is literal.

SQLite, MS SQL:

• Standard quote doubling. Backslash is literal.

The real answer: use parameterized queries. Every modern DB driver supports them. Never concatenate user input into SQL.

Manual SQL escaping has caused more security disasters than any other escape mistake.

Regular Expressions

RegEx metacharacters need escaping when you want them as literals:

When constructing a regex from user input, escape every potential metacharacter:

Inside character classes ([ ]), different chars are special: -, ], \, ^ (at start).

CSV

CSV (RFC 4180):

• Fields separated by commas (or another delimiter).
• Fields containing commas, quotes, or newlines must be quoted.
• Inside a quoted field, a literal quote is doubled.

Example:

Edge cases:

• BOM at start: Excel writes a UTF-8 BOM (\uFEFF); many parsers must accept and strip.
• Different delimiters: comma in US, semicolon in regions where comma is decimal separator.
• Line endings: RFC says CRLF; many tools accept LF.
• Empty fields: a,,b has an empty middle field.

For programmatic CSV, use a library (papaparse, Python's csv module, etc.), hand-rolled parsers fail on edge cases.

URL Encoding

Not in this tool's set but related. Three flavors:

• encodeURIComponent: encodes /, ?, &, =, +, #. Use for query string values.
• encodeURI: encodes only non-URL characters; preserves /, ?, &, etc. Use for full URLs.
• application/x-www-form-urlencoded: like encodeURIComponent but space → +, not %20.

Common bug: using the wrong encoder. encodeURI doesn't escape & because in a URL it's a query separator, but if you're encoding a value to GO INSIDE a query parameter, you need encodeURIComponent.

Common Pitfalls

HTML-escaping a URL or JS

Doesn't help against XSS in those contexts.

User can submit javascript:alert(1) and it'll be allowed because HTML escaping doesn't touch the colon, alphanumerics, or parens.

Fix: validate URL scheme separately.

Double-escaping

Applying the same escaper twice:

Common in pipelines where each layer "helpfully" escapes. Track what's already escaped and don't redo it.

Wrong-direction escaping

You receive an escaped string and forget to UNescape before processing:

Fix: decodeURIComponent(filename).

Encoding mismatch with bytes

JSON, HTML, etc. are character-based. If your data is bytes (binary), you need a binary-safe encoding like base64, not character escaping. Don't try to "escape" binary into JSON; encode it to base64 then put the base64 string in JSON.

Decision Tree

Privacy

All escaping is JS string replace operations with mapping tables running locally. The strings you paste, sometimes raw user input, sometimes debug data with PII, sometimes proprietary code snippets, stay in the tab. Open DevTools Network during use: zero outbound requests. A tool that uploaded escape candidates would be leaking sensitive context just by routing them through a server.