String Escape And Unescape
For Code, SQL And HTML

What A String Escape Tool Does For You

Some characters carry a special meaning in code. A quote ends a string. A backslash starts an escape. An ampersand starts an entity. So one stray character can break a whole line.

A string escape tool fixes that. First, you paste your text. Then you pick a format such as JavaScript, SQL or HTML. The safe version appears as you type, and you copy it with one click.

Also, it works both ways. Escape turns raw text into a safe string. Unescape turns a safe string back into text you can read. So you can check what a log line or an old string really says.

Everything runs in your browser. So your text never leaves your device. That matters, because the strings you handle may hold queries, keys and private data.

Escape And Unescape HTML

HTML treats the less than sign and the ampersand as markup. So you must escape them before you show code on a page. The tool turns the ampersand into &, the less than sign into < and the greater than sign into >. It also handles both kinds of quote.

Next, you can turn letters such as é into numeric entities like é. Also, you can turn line breaks into br tags. Then you paste the result straight into a page.

For more detail, see: MDN guide to JavaScript grammar and types.

Escape And Unescape XML

XML is stricter than HTML. It knows five entities: &, <, >, " and '. So the tool uses ' for the single quote, where HTML uses a number.

Then unescape reads those entities back, and numeric ones too. Also, the line break option turns a new line into 
, which keeps a line break inside an attribute.

Escape A JavaScript String

JavaScript strings use a backslash for special characters. So a new line becomes \n, a tab becomes \t and a backslash becomes two. First, you choose double quotes, single quotes or backticks. Then only the quote you picked gets a backslash.

Also, a backtick string keeps ${ safe, so a template literal does not run code by accident. Next, tick Escape non-ASCII characters to turn accented letters into Unicode escapes. Then the string works in any file encoding.

Escape A JSON String

JSON is stricter than JavaScript. It allows only double quotes, and it has no octal escapes. So the JSON option follows the JSON rules exactly.

First, it escapes quotes, backslashes and control characters. Then you paste the result between two double quotes, and the value is valid JSON.

Escape Strings For Java, C# And Python

Java, C# and Python share the same base. They use backslash n, backslash t and a backslash before a quote. However, each has its own details. Java has no vertical tab escape. C# has a bell escape. Python uses x for control characters and a capital U for characters beyond the basic plane.

So the tool follows each language, not one generic rule. Also, the Declare a variable option wraps the result in code. For example, it writes const text = "..."; for JavaScript and String text = "..."; for Java. Then you paste a ready line.

Escape A PHP String

PHP has two kinds of string. Single quotes know only two escapes, the backslash and the single quote. Double quotes also know \n, \t and \$.

So the quote style option picks the right rule. First, choose single quotes for plain text. Then choose double quotes when you need new lines or special characters.

Escape A SQL String

In standard SQL, you escape a single quote by doubling it. So O'Brien becomes O''Brien. However, MySQL also accepts a backslash. So tick MySQL backslash style to get a backslash before quotes, new lines and the rest.

Also, Wrap in quotes gives you the finished literal. Use it for quick fixes only. Then use parameters in real code, because a prepared statement is safer than any escape.

Escape A CSV Field

A CSV field needs quotes when it holds a comma, a quote or a line break. Inside the quotes, you double each quote. So the tool adds quotes only when they matter.

Also, tick Always quote the field to force them. Then unescape reads a quoted field back into plain text.

Add Slashes And Strip Slashes

The add slashes format works like the PHP function of the same name. It puts a backslash before a single quote, a double quote and a backslash. Then unescape removes those backslashes again.

Escape A URL

A URL allows only a small set of characters. So other characters become a percent sign and two hex digits. For example, a space becomes %20 and é becomes %C3%A9.

Also, tick Use a plus sign for spaces for form data. Then unescape reads either form back.

Escape A Regex

A regular expression treats dots, stars and brackets as commands. So to match them as plain text, you add a backslash. The Regex format does that for every special character.

Then you can paste a literal phrase into a pattern safely.

Unescape A String

Paste an escaped string and choose Unescape. First, the tool removes the quotes or the variable declaration if it finds one. Then it reads every escape and shows the plain text.

So you can read a string copied from a log, a database or a source file.

Check The Round Trip

Press Swap sides, and the result moves to the left box while the direction flips. So you can check a round trip in one click. If the text returns unchanged, the escape is sound.

Safe By Design

First, the tool works on plain text in your browser. It sends nothing, and it stores nothing. So your text stays yours.