How to use the string escape and unescape
- Choose the format you are working with: JSON, JavaScript, CSV or SQL. Each one has its own rules for quotes and special characters.
- Choose Escape to turn plain text into a safe string, or Unescape to turn an escaped string back into plain text.
- Paste your text. Options for the chosen format appear, such as the quote style for JavaScript, the field delimiter for CSV or the SQL style.
- Check the result box and press Copy result. Use Use the result as input to run the output through the opposite direction and confirm that you get your original text back.
Worked examples for each format
In JSON, the text He said "hi" followed by a new line and Next line becomes He said \"hi\"\nNext line. The double quotes get a backslash and the line break becomes the two characters \n.
In JavaScript with single quotes, it's "fine" C:\temp becomes it\'s "fine" C:\\temp: the apostrophe and each backslash get a backslash. In CSV, say "hi", ok becomes "say ""hi"", ok" because the field contains a comma and quotes, so it is wrapped in quotes and each inner quote is doubled. In SQL, O'Brien's order becomes O''Brien''s order, and with Wrap in quotes switched on it becomes 'O''Brien''s order'.
What each format escapes
JSON strings must escape the double quote, the backslash and every control character below U+0020. Short forms such as \n and \t are used where they exist and \u0000 style escapes everywhere else. An option can also write every non-ASCII character as a \u escape, with characters outside the basic plane written as a surrogate pair.
JavaScript escapes the backslash, the quote you chose (single, double or backtick) and the control characters. The two line separator characters U+2028 and U+2029 are always written as escapes, and for template literals the sequence dollar sign plus brace is escaped so it cannot start an expression. Unescape reads \n, \x41, \u0041 and \u{1F600} forms and rejects old octal escapes.
CSV needs quotes only when a field contains the delimiter, a double quote or a line break, and then each inner double quote is doubled. SQL string literals in the standard style double every single quote. A second style also puts a backslash before backslashes, quotes and NUL, which matches how some databases read string literals by default. Check your own database manual for the style it expects.
What escaping does not do
Escaping text by hand is a convenience for building examples, test data and one-off scripts. It does not make it safe to join user input into a database query. For queries, use parameters or prepared statements so that values never become part of the query text. For CSV and JSON files that a program writes, use the library for that format.
Everything runs in your browser. The text you paste is not sent anywhere and is not stored. Input is limited to 1,000,000 characters so the page stays responsive. For related conversions, try the URL encoder and decoder, the Base64 encoder and decoder or the JSON formatter.
Assumptions and limits
- JSON output follows the standard string rules. Unescape accepts text with or without the surrounding double quotes.
- JavaScript unescape does not run any code. It reads escape sequences as text and reports a clear message for a malformed \x or \u escape.
- The SQL backslash style is one common convention. Databases differ, so confirm which style yours uses.
- Only one string is handled at a time. A whole CSV file or JSON document should be processed by a proper parser.
Frequently asked questions
How do I escape a double quote in JSON?
Put a backslash in front of it, so " becomes \". Backslashes must also be doubled, and line breaks and tabs are written as \n and \t. This page does all of that for you.
Why does my CSV field get wrapped in quotes?
A field that contains the delimiter, a double quote or a line break has to be wrapped in quotes, otherwise a reader would split it into several columns. Tick Always quote the field if you want every value wrapped.
Is escaping enough to prevent SQL injection?
No. Escaping helps when you write a one-off statement by hand, but a program that builds queries from user input should use parameters or prepared statements instead of text joining.
What is the difference between escaping and encoding?
Escaping protects special characters inside a particular syntax, such as a quoted string. Encoding, such as Base64 or percent-encoding, changes the whole value into a different representation. They solve different problems.