String Escape

Purpose

String escape/unescape for JSON / JavaScript / Java / Python / SQL / HTML / Shell / Regex contexts. Converts strings with special characters (newlines, quotes, backslashes, tabs, Unicode) to language-specific escaped forms; reverses escaped strings back to readable. Common for pasting logs/errors into code string literals, embedding JSON in JSON/SQL, debugging escape mojibake, generating cross-language string literals. All processing runs locally.

Steps

1. Paste source text (with newlines / quotes / special chars)
2. Pick target language: JSON / JS / Java / Python / SQL / HTML / Shell / Regex
3. Right pane shows escaped output for that language
4. Reverse: paste an escaped string for auto-unescape
5. JSON escapes: \\n \\t \\" \\\\ \\u00XX
6. SQL escapes: escape single quotes by doubling them; escape double quotes and backslashes per dialect
7. Shell escapes: wrap in single quotes or use \\$ \\` \\" inside double quotes
8. Regex escapes: metacharacters . * + ? ( ) [ ] need a leading backslash

FAQ

What is the difference between JSON and JavaScript string escapes?

Core characters (\n \t \" \\) are identical. Differences: 1) JSON does not allow single-quote strings; JS does; 2) JSON disallows trailing whitespace / comments; JS allows; 3) JS supports \u{XXXX} and \xXX; JSON only \uXXXX; 4) JS template literals support ${}; JSON does not. JSON escapes are a strict subset of JS.

How to prevent SQL injection via escaping?

Escape is unreliable (rules vary). Use parameterized queries / prepared statements: `SELECT * FROM users WHERE name = ?` + parameter. Manual escape only when necessary: single quote → two single quotes ("); backslash per database (MySQL escapes by default; PostgreSQL does not). The tool’s SQL mode follows MySQL standard.

Shell single-quote vs double-quote escapes differ?

Single quote: all chars literal, cannot contain a single quote (need to splice with shell escape tricks). Double quote: still parses $variables, `commands`, \\ escapes. Best practice: single-quote for fixed strings, double-quote with careful escaping for variables, heredoc for complex multi-line.

Which regex metacharacters need escaping?

14 metacharacters: . * + ? ^ $ ( ) [ ] { } | \ / (the / only in JS literal regex string). Inside character class [ ]: most metacharacters lose meaning but ] ^ - still need escape (position matters). The regex mode follows PCRE.

Do Unicode characters need escaping?

JSON / JS: preserve UTF-8 (write Chinese / Emoji directly) for readability. When escape needed: \uXXXX (BMP) or \u{XXXXX} (JS ES2015+ for beyond-BMP). Legacy system integration: older PHP / Java may require pure ASCII — use \u for all non-ASCII. ASCII-only mode generates fully-escaped output.

Use cases

• Log → code string: paste multiline error logs into unit tests
• JSON nesting: embed JSON string as a field value of another JSON
• SQL generation: safely embed user input with quotes (though parameterized is preferred)
• Shell scripts: generate command strings with paths / quotes
• Regex templates: escape user input as literal characters when generating regex dynamically

Use cases

Logs to code, JSON nesting, SQL generation, shell scripts, dynamic regex. High-frequency multi-language escape. Multi-language context, bidirectional, optional Unicode mode are the differentiators.