String Escape & Unescape

about this tool

Each language, its own rule

Escaping is not one operation with a shared answer. The differences between targets are small, undocumented in most places, and exactly where mistakes turn into bugs.

SQL doubles a quote. It does not use a backslash, so O'Brien becomes O''Brien. Escaping is also no substitute for a parameterised query: if the value came from someone else, bind it rather than paste it.

CSV doubles a quote too, but only wraps a field when it contains a comma, a quote, a newline, or leading or trailing space. Quoting everything is legal and ugly; quoting nothing corrupts the file the first time a value has a comma in it.

A shell single-quoted string has no escape character at all. There is no way to put a quote inside one. The only correct form is to close the string, add an escaped quote, and reopen it, which is why it's becomes 'it'\''s'. Everything else inside the quotes, including $(...) and ;, is inert.

HTML and XML disagree on the apostrophe. XML defines '; HTML does not, so a numeric reference is used instead.

A regular expression needs every character with a special meaning escaped, so the text matches itself rather than acting as a pattern.

Control characters

Characters below space are invisible in a terminal and in most editors, so they are always escaped rather than passed through. A stray one of these is a common cause of a string that looks identical to another but does not compare equal.

Round trips

Every reversible target survives escaping and unescaping back to the original text, and there is a test for each. Shell and regular expression escaping are marked one-way, because they genuinely are: the output is a command argument or a pattern, not an encoded form of the input.