Skip to content

Escape String Online for JSON, SQL, CSV, Shell, Regex and HTML

Paste text, pick the format it is going into, and get it back with the right characters escaped. The same text can be unescaped again.

Runs in your browserFree, no sign-upLast reviewed

Settings

Results update automatically as you type.

Escaped

"He said \"it's fine\" — path C:\\temp\nSecond line"

Newlines become \n, tabs \t, and backslashes and double quotes are escaped.

Summary

Input length
46 chars
Output length
52 chars
Characters escaped
4

Quick answers

How do I escape a double quote in a JSON string?
Put a backslash in front of it. She said "hi" becomes "She said \"hi\"" as a JSON string. A backslash itself becomes two backslashes, a line break becomes \n and a tab becomes \t.
How do I escape a single quote in SQL?
Double it. In standard SQL the name O'Brien is written as the literal 'O''Brien'. A backslash is not an escape character in standard SQL, so this tool leaves backslashes alone.
How do I escape a single quote in a shell command?
Wrap the text in single quotes and replace each single quote inside it with '\'' (quote, backslash, quote, quote). it's $HOME becomes 'it'\''s $HOME', and the shell passes it as one literal argument without expanding $HOME.
Which characters need escaping in a regular expression?
The metacharacters . * + ? ^ $ { } ( ) | [ ] and the backslash, plus the forward slash when the pattern is written between slashes. Price: $5.00 (approx.) becomes Price: \$5\.00 \(approx\.\).
How do I escape a comma or quote in a CSV field?
Wrap the whole field in double quotes and double any double quote inside it. Smith, John "JJ" becomes "Smith, John ""JJ""". CSV does not use backslashes for escaping.
What does it mean to escape a string?
It means rewriting the characters that have a structural meaning in a format, such as a quote that would end the string, so they are read as ordinary text. The rewritten form depends on the format: a backslash in JSON, a doubled quote in SQL and CSV, an entity in HTML.

How String Escaper works

This tool escapes a string for seven targets: a JSON string, a JavaScript string literal, a SQL single-quoted string, a CSV field, a shell argument, a regular expression literal and an HTML attribute value. Each one uses a different rule. JSON and JavaScript put a backslash in front of quotes and backslashes and turn line breaks into \n. SQL and CSV double the quote character instead. A shell argument is wrapped in single quotes, a regex gets a backslash before every metacharacter, and an HTML attribute uses entities such as ". Set Direction to Unescape to reverse the change. The text is processed in your browser and is not sent anywhere.

What each format escapes

These are the exact changes this tool makes for each choice in Escape for.

FormatCharacters changedWritten asWrapper when quotes are included
JSON string, JavaScript string literalDouble quote, backslash, line break, carriage return, tab, backspace, form feed, other control characters\" \\ \n \r \t \b \f, and \u followed by four hex digits for the restDouble quotes
SQL single-quoted stringSingle quoteTwo single quotesSingle quotes
CSV fieldDouble quoteTwo double quotesDouble quotes, always added when the field has a comma, quote or line break
Shell argumentSingle quote'\''Single quotes, always added
Regular expression literal. * + ? ^ $ { } ( ) | [ ] \ /The same character with a backslash in frontNone
HTML attribute value& " ' < >&amp; &quot; &#39; &lt; &gt;Double quotes

Accented letters, emoji and other non-ASCII characters are left as they are in every format.

The same string escaped seven ways

Input: O'Brien, with Include surrounding quotes ticked.

Escape forResult
JSON string"O'Brien"
JavaScript string literal"O'Brien"
SQL single-quoted string'O''Brien'
CSV field"O'Brien"
Shell argument'O'\''Brien'
Regular expression literalO'Brien
HTML attribute value"O&#39;Brien"

An apostrophe is only a problem where the single quote is the delimiter (SQL, shell) or where both quote types are escaped for safety (HTML attributes).

String escape examples

Each result is the tool's output with Include surrounding quotes ticked.

Multi-line text into JSON

She said "hi" [line break] New line [tab] Tabbed C:\temp

"She said \"hi\"\nNew line\tTabbed C:\\temp"

The line break and tab become the two-character sequences \n and \t, so the value fits on one line.

A URL into a regex

https://example.com/a?b=1

https:\/\/example\.com\/a\?b=1

Without the escapes, the dot would match any character and the question mark would make the a optional.

Text with markup characters into an HTML attribute

a "b" & <c>

"a &quot;b&quot; &amp; &lt;c&gt;"

Unescaping a JSON string

"Line one\nLine \"two\"\t\u00e9" with Direction set to Unescape

Line one, then on a new line: Line "two", a tab, and the letter é

The outer quotes are removed and every escape sequence is turned back into the character it stands for.

Unescaping a SQL literal

'O''Brien' with Direction set to Unescape

O'Brien

Escaping SQL by hand is not a defence against injection

The SQL option exists for writing a one-off statement yourself, for example an INSERT you are about to paste into a database console. It doubles single quotes and does nothing else.

That is not enough for application code. Some databases, MySQL in its default mode among them, also treat a backslash as an escape character, so a rule that is correct for one server is incomplete on another. Hand escaping also has to be applied at every place a value enters a query, and one missed place undoes the rest.

Parameterised queries avoid the problem: the statement and the values are sent separately, so a value is never parsed as SQL. The same idea applies to the other formats. Build JSON with a serialiser, write CSV with a CSV library, and pass arguments to a subprocess as a list instead of assembling a shell command as one string.

Limits of the Unescape direction

Unescape reverses what Escape produces. It is not a full parser for each language.

  • JSON and JavaScript share one unescaper that follows JSON rules. JavaScript-only sequences such as \' and \x41 are rejected with the message that the text does not look like a valid escaped string.
  • The JSON and JavaScript unescaper also rejects input that contains a real line break or tab. An escaped string keeps those as \n and \t, so paste it as a single line.
  • HTML attribute value turns &quot;, &#39; and &amp; back into characters, but leaves &lt; and &gt; as they are. Use the HTML entity encoder to decode every entity.
  • SQL, CSV and Shell argument remove one quote from each end, then undo the doubled quote or the '\'' sequence.
  • Regular expression literal removes the backslash only from the characters the escaper adds one to, so classes such as \d and \w are left untouched.

How to use it

  1. 1

    Choose the destination in Escape for: JSON string, JavaScript string literal, SQL single-quoted string, CSV field, Shell argument, Regular expression literal or HTML attribute value.

  2. 2

    Leave Direction on Escape, or switch it to Unescape to turn an escaped string back into plain text.

  3. 3

    Tick or untick Include surrounding quotes depending on whether you want the delimiters in the output.

  4. 4

    Paste your text into Input, line breaks and tabs included.

  5. 5

    Copy the Escaped result and read the note under it, which describes the rule used for that format. When unescaping, the result is labelled Unescaped and has no note.

Answers to common questions

What is the difference between JSON and JavaScript string escaping?
For double-quoted strings they are almost the same, and this tool produces identical output for both. JavaScript also accepts single-quoted and template strings and a few extra sequences, such as \v, \0 and \x41, that JSON does not allow. Any valid JSON string is also a valid double-quoted JavaScript string.
Why does the shell result contain '\''?
Inside single quotes a shell treats every character literally, which means there is no way to escape a single quote there. The sequence closes the quoted section, adds one escaped quote, and opens a new quoted section. The shell joins the three pieces into a single argument.
When does a CSV field need quotes?
When it contains a comma, a double quote or a line break. With Include surrounding quotes unticked, the tool adds quotes only in those cases, so plain stays plain. With the box ticked, every field is quoted, which is also valid CSV.
Does Include surrounding quotes apply to every format?
No. A shell argument is always wrapped in single quotes, because the wrapper is what makes it safe. A regular expression never gets a wrapper. For JSON, JavaScript, SQL and HTML the box decides whether the delimiters are part of the output.
What does the Characters escaped figure count?
It is the number of characters the output gained, not counting two surrounding quotes when the box is ticked. O'Brien escaped for SQL shows 1. For the regex option untick the box to get the right figure, and for the shell option keep it ticked. A CSV field that is quoted automatically while the box is unticked reads 2 too high.
Does the regex option escape a hyphen?
No. A hyphen only has a special meaning inside a character class, between two other characters. If you are placing the escaped text inside square brackets, add a backslash before each hyphen yourself.
Are non-English characters converted to \u codes in JSON?
No. JSON allows any Unicode character inside a string, so café stays café. Only the double quote, the backslash and control characters below U+0020 are rewritten.
Should I escape URLs with this tool?
Not for use inside a link. URLs use percent encoding, where a space is written %20, and that is a separate tool on this site. Use the regex option here only when you want a pattern that matches a URL literally.

Related tools

HTML Entity Encoder & Decoder

Escape characters that would break HTML into entities, or decode entities back into readable text.

Open tool

URL Encoder & Decoder

Percent-encode or decode text and query strings so they are safe to use inside a URL.

Open tool

JSON Formatter & Validator

Beautify, minify and validate JSON with clear error messages and a breakdown of the structure.

Open tool

Chmod Calculator

Tick read, write and execute for owner, group and other to get the octal chmod value, the symbolic string and the command to run.

Open tool

Cron Expression Generator

Build a cron schedule from plain options and read back exactly what it means in English.

Open tool

CSS Minifier

Shrink CSS by removing comments, whitespace and the last semicolon in each rule.

Open tool

Looking for something else? Browse all developer tools or see every tool.