String Escape & Unescape

about this tool

Each language, its own rule

Escaping is not one operation with a shared answer. The differences between targets are small, undocumented in most places, and exactly where mistakes turn into bugs.

SQL doubles a quote. It does not use a backslash, so O'Brien becomes O''Brien. Escaping is also no substitute for a parameterised query: if the value came from someone else, bind it rather than paste it.

CSV doubles a quote too, but only wraps a field when it contains a comma, a quote, a newline, or leading or trailing space. Quoting everything is legal and ugly; quoting nothing corrupts the file the first time a value has a comma in it.

A shell single-quoted string has no escape character at all. There is no way to put a quote inside one. The only correct form is to close the string, add an escaped quote, and reopen it, which is why it's becomes 'it'\''s'. Everything else inside the quotes, including $(...) and ;, is inert.

HTML and XML disagree on the apostrophe. XML defines '; HTML does not, so a numeric reference is used instead.

A regular expression needs every character with a special meaning escaped, so the text matches itself rather than acting as a pattern.

Control characters

Characters below space are invisible in a terminal and in most editors, so they are always escaped rather than passed through. A stray one of these is a common cause of a string that looks identical to another but does not compare equal.

Round trips

Every reversible target survives escaping and unescaping back to the original text, and there is a test for each. Shell and regular expression escaping are marked one-way, because they genuinely are: the output is a command argument or a pattern, not an encoded form of the input.

For JSON specifically, JSON escape & unescape also repairs near-JSON back into the strict form, and HTML entities goes further for markup with a searchable entity reference. When a string will not match and the escaping is not the reason, the Unicode character inspector shows every character in it, including the ones with no width.

questions

Which languages and formats can it escape for?

Ten, each following its own rules: JavaScript, JSON, HTML, XML, SQL, CSV, shell, regular expressions, Java and Python. The rules genuinely differ, which is why one generic escaper gets it wrong.

Why can shell and regex escaping not be reversed?

Because both are lossy in the direction that matters. Shell quoting has several forms that produce the same result, and a regex escape turns a character into a pattern, so there is no single original to recover. The other eight targets round-trip exactly.

Is escaping SQL a safe way to prevent injection?

No, and this is the important caveat. Escaping by hand is a last resort for a one-off query you are writing yourself. Anything taking user input must use parameterised queries or prepared statements, which never build a string in the first place.

What is the difference between escaping for HTML and for XML?

HTML has named entities such as   and a fixed set of characters that break markup. XML defines only five entities and is stricter about which characters are legal at all, so text valid in HTML can be rejected by an XML parser.

Does my text get sent anywhere?

No. Escaping and unescaping run in your browser, which matters because the strings people escape are often connection strings, keys or customer data being pasted into code.