Escape / Unescape

The right escaping for the right context

Escaping bugs are context bugs: HTML entities inside a JavaScript string, SQL quoting applied to JSON, CSV fields that break on an unquoted comma. Each tool here implements one context's exact rules — HTML/XML entity encoding, JavaScript and Java string literals, .NET verbatim strings, JSON's backslash escapes, CSV's quote-doubling, SQL's single-quote doubling — with both escape and unescape directions, so a string can be safely embedded or recovered without consulting a spec.

Every page round-trips: escape, then unescape, returns the original byte-for-byte, including Unicode beyond the ASCII range. That property is the test these tools are built against, and it's why copying a result into source code or a data file just works.

Escaping is encoding, not security

A word of honesty that competitor pages skip: escaping makes text safe to embed in a syntax, not safe in the security sense. SQL escaping prevents a quote from terminating a literal — parameterized queries are still the real injection defense; HTML escaping prevents markup interpretation — a CSP and framework auto-escaping are still your XSS strategy. Use these tools for correctness in fixtures, logs, config files, and migrations, and keep the security mechanisms in your stack.

Which escape scheme do I need?

The escape tools split into a few real syntactic families, not eleven unrelated pages. HTML and XML share entity encoding — the same handful of special characters turned into named-entity sequences — differing mainly in which named entities each markup language recognizes. JavaScript, Java, .NET and Python share C-style string-literal escaping — backslash sequences for quotes and control characters, plus Unicode escapes for Java, .NET and Python's ASCII-only mode — differing mainly in which characters get that Unicode treatment and, for Python, whether it uses a surrogate pair or a single \U escape for characters above the Basic Multilingual Plane. JSON escaping is its own strict subset of that grammar, defined by RFC 8259 rather than a compiler. Regex escaping is a family of its own — it hides metacharacters from a PATTERN COMPILER, not from a string parser, so its character set (dots, parentheses, brackets) has nothing to do with the C-style family. CSV escaping and shell quoting are both wrapping mechanisms rather than backslash schemes — CSV wraps a field in quotes and doubles inner quotes, POSIX shells wrap a whole word in single quotes and splice out any embedded one — and SQL escaping is simpler still: doubling the single quote that delimits a string literal. Picking the right tool is really picking the right family, then the right member of it.