String escape and unescape
Type in the Text box to escape it for your language, or paste an escaped string into the Escaped box to read it. Both update as you type.
How to escape a string
- Pick the language the string goes into. Each has its own rules: JSON needs
\"and\\, SQL doubles single quotes (it''s), bash wraps the text in single quotes. - Type or paste the text into the Text box. Copy the result from the Escaped box, or tick Add quotes to get a complete literal.
- To unescape, paste an escaped string (with or without its quotes) into the Escaped box. Invalid escapes are reported with their position.
Escape sequences by language
| Language | Escapes | Unicode |
|---|---|---|
| JSON | \" \\ \/ \b \f \n \r \t | \u00E9, surrogate pairs above U+FFFF |
| JavaScript | JSON's, plus \' \` \v \0 \xE9 | \u00E9, \u{1F600} |
| Java | \" \' \\ \b \f \n \r \t \s, octal \101 | \u00E9 |
| Kotlin | \" \' \\ \$ \b \n \r \t (no \f) | \u00E9 |
| C# | \" \' \\ \0 \a \b \e \f \n \r \t \v | \u00E9, \U0001F600, \xE9 |
| Python | \" \' \\ \a \b \f \n \r \t \v, \xe9, octal | \u00e9, \U0001f600, \N{name} (not decoded here) |
| Go | \" \\ \a \b \f \n \r \t \v, \x bytes, octal \101 | \u00E9, \U0001F600 |
| C, C++ | \" \' \\ \? \a \b \f \n \r \t \v, octal, \x | UTF-8 bytes, or \u in C11/C++11 |
| SQL | '' for a quote inside '...' | none needed |
| bash | 'it'\''s', or $'\n' for control characters | none needed |
Escaping is not a defense against injection
Escaping a value by hand and gluing it into SQL or a shell command is how injection bugs happen. Use parameterized queries (? or $1 placeholders) for SQL, and pass arguments as an array (subprocess.run([...]), execFile) instead of building a command string. This tool is for writing literals in code, config and tests.
Questions
How do I escape a double quote in JSON?
Put a backslash before it: \". A backslash itself becomes \\, and a line break becomes \n. JSON strings can't contain raw line breaks or tabs.
How do I escape a single quote in SQL?
Double it: 'it''s' is the text it's. That's standard SQL and works in PostgreSQL, SQLite, SQL Server, Oracle and MySQL. For values from users, use query parameters instead.
How do I put a single quote inside a single-quoted bash string?
You can't escape it inside the quotes, so close the quote, add an escaped quote and reopen: 'it'\''s'. Or use $'it\'s'.
What does \u00e9 mean?
It's the character with Unicode code point U+00E9 (é), written with only ASCII characters. JSON, JavaScript, Java, C#, Python and Go all understand it. Characters above U+FFFF, like emoji, need \u{1F600} in JavaScript, \U0001F600 in Python, C# and Go, or a surrogate pair (\uD83D\uDE00) in JSON and Java.
Why does the C output use octal like \303\251?
In C, \x reads every hex digit that follows, so \xE9a would be one huge number. Octal escapes stop after three digits, so they can't swallow the next character.
Which characters need escaping in a regex?
These have special meaning: \ ^ $ . * + ? ( ) [ ] { } | and / in JavaScript literals. The Regex option puts a backslash before each, so the pattern matches the text literally outside a character class, including with JavaScript's u and v flags.