How to escape a string
- Choose the target: JSON, JavaScript, Java/C#/C, Python, SQL, CSV, XML/HTML, a regular expression, a Bash shell argument or PHP.
- Paste the raw text and press Escape. Quotes, backslashes, newlines, tabs and control characters are converted to the correct escape sequences for that language, and the result can be wrapped in the right quotes.
- Press Unescape to go the other way, for example to read a JSON string full of
\nand\", or a log line with\u00e9sequences.
Escaping rules by language
- JSON: double quotes, backslashes and control characters must be escaped; everything else may appear as is.
- JavaScript, Java, C#, C, Python: backslash escapes such as
\n,\t,\"and\\. Windows paths are a classic trap:C:\newcontains a newline unless escaped. - SQL: single quotes are doubled (
O''Brien). For real queries always use parameterised statements instead of building strings. - CSV: quotes inside a field are doubled and the field is wrapped in quotes.
- Regex: metacharacters
. * + ? ^ $ { } ( ) | [ ] \ /are escaped so the text matches literally. - Bash: the text is wrapped in single quotes, and any single quote becomes
'\'', which makes it safe as one argument.
Everything happens in your browser, so you can safely escape secrets, connection strings and private data.
Why does my JSON have \u characters?
Some encoders write non-ASCII characters as \uXXXX escapes. They are valid JSON; choose JSON and press Unescape to read them as normal text.
Is escaping enough to prevent SQL injection?
No. Escaping helps, but the reliable protection is prepared statements with bound parameters, which every database driver supports.
How do I escape a string for HTML attributes?
Choose XML / HTML. It escapes &, <, > and both quote characters, which is safe for text content and quoted attribute values.