String Escape and Unescape

About String escape and unescape

Escapes or unescapes text for nine targets: JavaScript, JSON, HTML, XML, SQL, URL, RegExp, shell and CSV. Each target has its own rules, so text that is safe inside a JSON string can still break a shell command. Pick the destination and a direction, and the output updates immediately.

How to use it

1. Choose a Target format. The description under the menu explains what that target changes.
2. Select Escape or Unescape.
3. Paste text into the input box, or press Load sample for a string that exercises that target.
4. Read the output and press Copy.
5. Use Use output as input to chain a second transformation or to check that a round trip returns the original.

SQL and shell escaping

SQL target: O'Brien's "order"
Shell target: rm -rf $HOME; echo "it's"

SQL: O''Brien''s "order"
Shell: 'rm -rf $HOME; echo "it'\''s"'

When to use it

• Embedding a multi-line message with quotes into a JavaScript string literal.
• Building an ssh or curl command around a value that contains spaces, quotes and dollar signs.
• Decoding a percent-encoded query string copied out of a log.
• Turning a phrase typed by a user into a regex that matches it literally.
• Preparing a CSV field that contains commas and quotation marks.

Questions about String escape and unescape

Does SQL escaping protect against injection?

Not by itself. Doubling single quotes is fine for a one-off literal typed into a console, but application code should use parameterized queries, as the tool's own description reminds you.

How does the shell target work?

It wraps the text in POSIX single quotes and rewrites each embedded single quote as quote, backslash, quote, quote. Inside single quotes nothing is expanded, so $HOME and backticks stay literal. It suits POSIX shells, not cmd.exe or PowerShell.

How do the JavaScript and JSON targets differ?

JavaScript escapes both quote kinds and backticks and writes control characters as hex escapes, returning only the inner text. JSON follows JSON.stringify, so it wraps the value in double quotes and leaves single quotes and Unicode alone.

Why does URL unescape turn plus signs into spaces?

Form-encoded query strings use a plus for a space, so the decoder swaps plus signs before percent-decoding. Encoding uses encodeURIComponent, which writes a space as %20 and also encodes characters such as slash and ampersand.

What happens when the input cannot be decoded?

JSON and URL unescaping show an error, for an invalid string or a malformed percent sequence. The other targets are lenient and pass unknown sequences through unchanged.

Related tools

• JSON validator & beautifierValidate JSON content and make it looks good.
• SQL formatter/beautifierFormat & beautify your SQL code with ease.
• Regex testerTest and debug regular expressions against any string input.
• JSON viewerExplore and search JSON data in a collapsible tree view.
• JSON to CSV converterConvert a JSON array into CSV with nested flattening, a custom delimiter and an optional header row.
• CSV to JSON converterConvert CSV text into JSON with delimiter auto-detection, header-row and type-coercion toggles.