String Escape and Unescape

Text that goes inside something else has to be escaped first: a quote inside a JSON string, an apostrophe inside a SQL literal, a space or $ inside a shell argument, a comma inside a CSV cell, a dot or bracket inside a regular expression. Get it wrong and the result breaks — or, with SQL and shell, becomes an injection hole. This tool escapes text for six formats and reads escaped text back, each by its own specification: JSON (RFC 8259), JavaScript string literals, standard SQL, POSIX shell single quotes, CSV (RFC 4180) and ECMAScript regular expressions. It is tested by feeding its output to the real thing — the JavaScript engine, RegExp and /bin/sh — and checking the original text comes back.

1. Choose Escape or Unescape, and the format the text is going into or coming out of.
2. Type or paste the text. The result updates as you type.
3. Copy it, or use the swap button to run the result the other way and check it round-trips.
4. Read any warning under the result — for example about MySQL’s backslash handling.

• SQL escaping follows the standard: a single quote is doubled. MySQL and MariaDB also treat backslashes as escapes unless NO_BACKSLASH_ESCAPES is set. For values in application code, use prepared statements instead of building SQL from strings.
• Shell escaping targets POSIX sh, bash and zsh. Windows cmd.exe and PowerShell quote differently.
• Regex escaping makes text match itself outside a character class. Inside [ ], a hyphen also needs care, and some engines other than JavaScript’s differ.
• Unescaping reads one value: a single shell word, a single CSV field, a single string literal. It refuses anything the shell would expand, such as $HOME, rather than guess.
• Everything runs in your browser. Nothing you type is sent anywhere or kept — this tool does not remember recent inputs, because people often escape passwords here.

Double it: O'Brien becomes 'O''Brien'. That is the SQL standard and works in PostgreSQL, SQLite, SQL Server, Oracle and MySQL. Better still, pass values as parameters of a prepared statement, so they are never part of the SQL text at all.

You cannot escape it inside the quotes, so close the quotes, add an escaped quote and reopen them: 'it'\''s' — which the shell reads as it’s. This tool writes that for you and only adds quotes when the text needs them.

JSON allows only double-quoted strings and the escapes \" \\ \/ \b \f \n \r \t and \uXXXX. JavaScript also accepts single quotes, \x41, \u{1F600} and \v. The JavaScript output here also escapes U+2028 and U+2029, which older engines treated as line breaks inside strings.

Put the whole field in double quotes, and write every double quote inside it twice: say "hi", then leave becomes "say ""hi"", then leave". Fields that contain a line break must be quoted too.

The syntax characters: \ ^ $ . * + ? ( ) [ ] { } | and /. Put a backslash in front of each to match it literally, so 1+1=2? becomes 1\+1=2\?. Escaping other characters, such as - or letters, is an error in JavaScript’s unicode mode.