Escape / Unescape

Escape and unescape strings for HTML, URL, JSON, CSS, SQL and JavaScript

Input

22 chars

Output

Hello \"World\"\nTab\there

About the String Escape Tool

This tool escapes a string for whichever context it is going into — HTML, JSON, URL, SQL or CSS. Each has different rules, and applying the wrong one is how quotes break syntax and injection bugs appear.

Escaping a string means making its characters safe for the context that will read it. The rules differ per context: HTML needs angle brackets as entities, JSON needs quotes and backslashes prefixed, URLs need percent-encoding, SQL needs quotes doubled, and CSS needs its own backslash form.

Using the wrong escaping is a real class of bug rather than a stylistic slip. HTML-escaping a value bound for a JSON string leaves the quotes unescaped and breaks the parse; URL-encoding something written into HTML leaves the angle brackets live. Context determines the rules.

For SQL specifically, escaping is the fallback and not the answer. Parameterised queries are the correct defence against injection because they never mix data with code. Escape only when building SQL by hand is genuinely unavoidable.

How to use the String Escape Tool

  1. Paste your string. Enter the value that needs escaping.
  2. Choose the target context. Pick HTML, JSON, URL, SQL or CSS.
  3. Read the escaped output. Check that the characters relevant to that context were handled.
  4. Copy the result. Use the escaped value in the right place.

String Escape Tool features

  • Six contexts: HTML, JSON, URL, CSS, SQL and JavaScript strings
  • Escapes exactly what that context requires and nothing more
  • Switch context without re-entering the text
  • Copy the result
  • Runs in your browser; nothing is uploaded

Frequently asked questions

Why does the context matter so much?

Because each one has different dangerous characters. HTML cares about angle brackets and ampersands, JSON about quotes and backslashes, URLs about spaces and reserved characters. Applying the wrong escaping leaves the real hazard untouched.

Is escaping enough to prevent SQL injection?

No. Use parameterised queries — they separate code from data so escaping is not needed. Escaping by hand is for inspecting or repairing a value, not a substitute for prepared statements.

What does HTML escaping actually change?

Ampersands, angle brackets and quotes become entities, so text displays as written instead of being parsed as markup. It is the difference between showing a code sample and executing it.

Can I escape several values at once?

It handles one block of text per pass. For a long list, a script or your language's own escaping function is the right tool — and safer, since it will not miss an entry.