Advertisement
Guide
About the String Escape Tool
Every language and context has characters that need escaping — quotes inside a JSON string, single quotes in a SQL value, spaces and special characters in a shell command, or metacharacters in a regular expression. Get the escaping wrong and you get syntax errors at best, or injection vulnerabilities at worst. This tool escapes a piece of text correctly for whichever target you choose.
Paste your text, pick JSON, JavaScript, SQL, shell, regex, HTML, or URL, and get a safely escaped result you can drop straight into code. Everything is processed locally in your browser.
Why escaping rules differ by target
Each context has its own “dangerous” characters. JSON needs quotes and backslashes escaped; a shell cares about spaces, quotes, and $; regex treats ., *, and brackets as operators. Using the wrong escaping — or none — is a common source of bugs and security holes, which is why this tool tailors the output to each target.
Escaping is not a substitute for parameterized queries
The SQL option is handy for quick scripts and literals, but for application code you should use parameterized queries (prepared statements) rather than manually escaping and concatenating values. Parameterization is the reliable defense against SQL injection; manual escaping is error-prone. Treat this tool as a convenience, not a security boundary.
How to use it
- 1Paste the raw text you need to embed somewhere.
- 2Choose the target: JSON, JS, SQL, shell, regex, HTML, or URL.
- 3Copy the escaped output into your code.
- 4For SQL in real applications, prefer parameterized queries over manual escaping.
Frequently asked questions
What does escaping a string mean?
It means adding special markers (like a backslash) so characters that would otherwise be interpreted as syntax are treated as literal text — for example turning a quote inside a string into an escaped quote.
Which target should I pick?
Match it to where the text will go: JSON for a JSON value, JS for a JavaScript literal, regex when inserting a literal into a pattern, shell for command arguments, and so on.
Does escaping protect against injection attacks?
It helps, but it is not a complete defense. For SQL, use parameterized queries; for HTML, prefer context-aware templating. Manual escaping is best for quick, controlled cases.
Can it escape regex special characters?
Yes. The regex option escapes metacharacters like . * + ? ( ) [ ] so your text matches literally rather than acting as a pattern.
Is my text uploaded?
No. All escaping runs in your browser and nothing is transmitted.