Text Escape
Escape for JSON, SQL, regex and shell
Escaping is how you tell a parser that a character is data rather than syntax. Every context has its own rules: JSON escapes with backslashes and requires control characters to be written as unicode sequences, regular expressions have a dozen metacharacters, shells treat quotes and dollar signs specially, and SQL doubles a single quote to embed one.
Getting this wrong is not merely untidy — escaping for the wrong context is the mechanism behind injection vulnerabilities. HTML-escaping a value that ends up inside a SQL query protects nothing at all. This tool applies the rules of each target explicitly so you can see what a correctly escaped string looks like, and unescape one to read what it really contains.
How to use it
- Paste the raw stringWhatever you intend to embed: a snippet of text, a path, a fragment of code.
- Choose the target contextJSON, SQL, regular expression, shell or HTML. The same input produces very different output for each, which is precisely the point.
- Unescape to inspectRunning the reverse on a string from a log or a config file shows what it actually contains, including any double escaping that crept in along the way.
Frequently asked questions
Does escaping protect me from SQL injection?
Not reliably, and it is the wrong tool for the job. Use parameterised queries, which send the statement and the values separately so a value can never be parsed as SQL. Manual escaping depends on getting the character set and the exact dialect right, and one missed case is a vulnerability. Escape only when you genuinely cannot parameterise, such as for an identifier.
Which characters must be escaped in JSON?
The double quote and the backslash always, plus control characters below U+0020, which must be written as escapes such as \n or \u0000. Forward slash may be escaped but does not have to be — you often see \/ in output because escaping it avoids accidentally closing a script tag when JSON is embedded in HTML.
How do I escape a string for a regular expression?
Precede every metacharacter with a backslash: the set is . * + ? ^ $ { } ( ) | [ ] \ and the forward slash if it delimits the pattern. Building a pattern from user input without escaping is both a correctness bug and a denial-of-service risk, since a crafted input can produce catastrophic backtracking.
Why is shell escaping so difficult?
Because the rules change with the quoting. Inside double quotes the shell still expands variables, backticks and history; inside single quotes almost nothing is special, but a single quote itself cannot appear at all and must be closed, escaped and reopened. The reliable answer is to avoid the shell entirely and pass arguments as an array.
How do I tell if a string has been escaped twice?
Look for doubled escape characters: \\n where you expected \n, or &lt; where you expected <. Unescaping once and inspecting the result is the quickest check. Double escaping usually means a framework is escaping automatically and something upstream already did it by hand.