String Escape and Unescape Tool
Escape or unescape text for JSON, JS, HTML, SQL, regex, shell and more. Runs in your browser.
About this string escape and unescape tool
This tool escapes and unescapes text for eleven contexts: JSON, JavaScript, HTML, XML, CSV, SQL, regular expressions, URLs, Java, C# and the shell. Pick the target, paste your text, and you get a string you can drop straight into code, a query or a command.
Escaping rules look alike but differ in ways that bite. JSON has no \' escape. SQL doubles quotes rather than adding a backslash, except MySQL, which does both. Shell single quotes cannot contain a single quote at all. Each mode here follows its own spec, and the rule in use is shown under the options so you know exactly what changed.
Unescape works the other way, so you can read a log line full of \n and \u00e9 or a URL full of %20. Everything runs in your browser.
Features
Eleven modes on one page
JSON, JavaScript, HTML, XML, CSV, SQL, regex, URL, Java, C# and shell, each with escape and unescape, and a Swap button to check the round trip.
Options that match real code
Pick single, double or backtick quotes for JavaScript, standard or MySQL rules for SQL, component, full URL or form encoding, and regular or verbatim strings for C#.
ASCII-safe output
Write every non-ASCII character as \uXXXX in JSON, JavaScript, Java and C#, with surrogate pairs for emoji, or as &#x…; references in HTML and XML.
Three shell styles
POSIX single quotes with the '\'' trick, Bash $'…' strings that can hold tabs and newlines, and PowerShell single quotes with '' doubling.
Strict where it should be
Unescaping JSON uses the real JSON parser, so an invalid escape like \x41 is reported instead of guessed. Broken percent-encoding and lone backslashes get clear errors too.
Shareable mode
The chosen mode and action are kept in the page address, so a link can open straight into SQL unescape or shell escape. Your text is never put in the URL.
How to use the string escape and unescape tool
- 1Pick the language or format, such as JSON, SQL or Shell.
- 2Choose Escape or Unescape and paste your text.
- 3Set options like quote style, then copy the result.
When to use it
Putting text inside a JSON string
Paste a multi-line error message or a Windows path and get a value with \n and \\ that you can place between quotes in a config file.
Writing a SQL literal by hand
Turn O'Brien into O''Brien for a quick fix in a console. For application code, use parameters instead; the page reminds you.
Matching a literal string with a regex
Escape a price like $9.99 (USD) so the dot and the brackets match themselves, then test it in the regex tester.
Passing an argument through the shell
Wrap a message with quotes, $ and spaces so bash passes it as one argument, untouched.
Reading an escaped log line
Unescape a JSON or Java string from logs to see the real line breaks and accented characters.
Which characters must be escaped in JSON?
RFC 8259, section 7, requires three groups: the double quote, the backslash and the control characters U+0000 to U+001F. Short forms exist for \" \\ \/ \b \f \n \r and \t. Any other character may be written as \u followed by four hex digits, and characters outside the Basic Multilingual Plane, like most emoji, take two of those as a surrogate pair.
Everything else, including é, 中 and the forward slash, can stay as it is. This tool also escapes U+2028 and U+2029, the line and paragraph separators, because JavaScript before ES2019 did not allow them unescaped inside string literals.
Escaping vs encoding: what is the difference?
Escaping keeps text inside one syntax. A backslash or a doubled quote tells the parser that the next character is data, not the end of the string. Encoding changes the representation of all the bytes, like percent-encoding for URLs or Base64 for binary data.
The URL mode here is encoding by that definition, and HTML entities sit in between. If you need named entities like é for a whole page, the HTML entity encoder covers the full list.
How do you escape a single quote in bash?
You can't escape it inside single quotes, because POSIX shells treat every character between single quotes as literal, backslash included. The usual trick is to end the quote, add an escaped quote, and start a new quote: 'it'\''s' is read as it's.
Bash and zsh also have $'…' strings, where \' and \n work as in C. PowerShell single-quoted strings double the quote instead: 'it''s'. Unescape in Shell mode splits a command into its words, which is handy for checking what a program will actually receive.
Does escaping prevent SQL injection?
Escaping helps, but it is the weak fix. One forgotten call, a different character set or a mode like MySQL's NO_BACKSLASH_ESCAPES can reopen the hole. Parameterized queries send the values separately from the SQL text, so input can never change the statement. OWASP lists them as the primary defense.
Use this mode for migrations, one-off fixes and seed scripts. For whole rows of data, the JSON to SQL converter writes complete INSERT statements with the quoting done for you.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Formats | Eleven on one page, both directions | One page per format |
| Rules shown | The exact rule for each mode, shown under the options | Not explained |
| SQL dialects | Standard and MySQL backslash rules | One rule for every database |
| Shell | POSIX, Bash $'…' and PowerShell | Rarely offered |
| Privacy | Text stays in your browser | Text posted to a server |
Tips
- For a JavaScript template literal, choose the backtick quote. $ is escaped so ${ cannot start an expression, and real line breaks are kept.
- In regex mode, tick Also escape - when the text goes inside square brackets, where a hyphen means a range.
- Form encoding writes spaces as +, which is what HTML forms send. Use component encoding for anything else, such as path segments.
- C# verbatim strings only double the quote, which makes Windows paths readable: @"C:\Users\maya".
Questions
How do I escape a string for JSON?
Choose JSON, keep Escape selected and paste the text. Quotes become \", backslashes become \\ and line breaks become \n. Tick Add surrounding quotes to get a complete JSON string.
How do I unescape a JSON string?
Choose JSON and Unescape, then paste the escaped text, with or without the outer quotes. \n, \t and \u escapes turn back into real characters.
How do I escape a single quote in SQL?
Double it: O'Brien becomes 'O''Brien'. That is standard SQL and works in PostgreSQL, SQLite, SQL Server and MySQL. MySQL also accepts \' in its default mode.
Which characters need escaping in HTML?
& and < always, > for safety, and " and ' when the text goes inside an attribute value. Those five are what OWASP recommends for HTML content and quoted attributes.
How do I escape special characters in a regex?
Put a backslash before each of ^ $ \ . * + ? ( ) [ ] { } | and /. Regex mode does this, so the pattern matches the text literally.
What is the difference between encodeURI and encodeURIComponent?
encodeURI leaves characters that structure a URL, like / ? & and =, alone. encodeURIComponent encodes them too, so use it for one query value or path segment.
Why did unescape say my JSON escape is invalid?
JSON allows only \" \\ \/ \b \f \n \r \t and \uXXXX. Escapes like \x41 or \' are JavaScript, not JSON. Switch to JavaScript mode to read them.
Is the text I paste sent anywhere?
No. Escaping and unescaping run in your browser, and the text is not saved or added to the URL.