String Escaper

What this tool does

String Escaper converts any text into a valid string literal for the language you choose, escaping quotes, backslashes, line breaks and control characters with the right syntax, and reverses the process. It covers 16 targets, from JSON and template literals to SQL, POSIX shell arguments and RFC 4180 CSV fields.

Pasting text into source code or a query is a classic source of bugs. A single apostrophe ends a SQL literal, a Windows path such as C:\new turns into a newline in many languages, a raw line break is invalid inside a JSON string, and a dollar sign starts interpolation in a PHP or JavaScript template. Each language has its own rules, and getting them wrong produces syntax errors at best and injection vulnerabilities at worst.

This tool applies the precise rules for each target. C-family formats (JSON, JavaScript, Java, C, C#, Go, Python, PHP double-quoted) escape backslashes, the active quote character, \n, \r, \t, \b and \f, write other control characters as \u or \x escapes, and can optionally escape every non-ASCII character, using surrogate pairs where the language needs them. SQL doubles single quotes, POSIX shell closes and reopens single quotes around each apostrophe, regex mode escapes metacharacters so text matches literally, CSV quotes fields per RFC 4180, and XML uses entity references. Unescape mode parses literals back to plain text, with errors for malformed escapes. Everything runs locally.

How to use String Escaper

1. Paste the text or literal into the Input box, or click Sample.
2. Choose Escape or Unescape under Mode.
3. Select the target under “Language / format”.
4. Switch on “Wrap result in quotes” to get a complete literal, and “Escape non-ASCII characters” for ASCII-only source files.
5. Turn on “Treat each line as a separate string” to process a list, then copy the output.

Tips for better results

• For SQL, prefer parameterised queries in application code; escaping is best kept for ad hoc queries and migration scripts.
• The shell format produces arguments that are safe in sh, bash and zsh, for example 'it'\''s' for it's.
• Regex mode escapes . * + ? ^ $ { } ( ) | [ ] \ and /, so the result can go between slashes in a JavaScript regex literal.
• JSON output is also a valid JavaScript double-quoted string, but not the other way round: JSON has no \x or \' escapes.

Common use cases

• Embedding a multi-line SQL query or HTML snippet in a Java, C# or Go string.
• Putting user-supplied text into a JSON fixture or API test by hand.
• Reading an escaped string copied from a log file or debugger.
• Building a regular expression that must match a URL or file path literally.

Common mistakes to avoid

• Escaping for one language and pasting into another: Python’s \x41 is meaningless inside JSON.
• Escaping text twice, which produces visible backslashes such as \\n in the final output.
• Using HTML or XML escaping for a JavaScript string inside a script tag; it needs JavaScript escaping instead.
• Relying on SQL escaping alone for untrusted input in production code instead of bound parameters.