String escape and unescape
This tool escapes text so it can sit safely inside code, or turns escaped text back into plain text. Developers use it when pasting messages, file paths and user text into JavaScript, JSON, SQL, CSV or regex patterns.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
He said "it's done" C:\temp\new
He said \"it\'s done\"\nC:\\temp\\new
How to use the string escape and unescape
- Paste your text into the Text box.
- Choose a Format, such as JavaScript string or SQL string (single quotes).
- Choose a Direction: Escape or Unescape.
- Press Run, then Copy result or Download.
How it works
JavaScript escapes backslashes, both quote types, line breaks, tabs and other control characters, so the result works inside single or double quotes. Unescape also reads \x, \u and \u{...} escapes and rejects old octal escapes.
JSON follows the JSON string rules. Unescape accepts the text with or without its surrounding double quotes.
CSV wraps a field in double quotes when it contains a comma, quote, line break or edge space, and doubles inner quotes. SQL doubles single quotes, the standard rule for single-quoted strings, and you add the outer quotes yourself.
Regex puts a backslash before \ ^ $ . * + ? ( ) [ ] { } | and / so the text matches literally. Unescape rejects tokens like \d that have no plain text form.
Escaping a SQL value is not a substitute for parameterized queries when you handle user input.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
How do I escape a single quote in SQL?
Write it twice, so O'Brien becomes O''Brien inside the quotes. MySQL in its default mode also treats a backslash as an escape character, so check any backslashes there too.
What is the difference between JavaScript and JSON escaping?
JSON only allows double-quoted strings and a fixed set of escapes, while JavaScript also allows single quotes, \x escapes and \u{...} code points.
Is escaping enough to stop SQL injection?
In application code, use parameterized queries. Escaping is useful for one-off scripts and data you control.
Is my text uploaded?
No. It runs in your browser, and nothing you paste is sent to a server.