About String Escape / Unescape

Escape and unescape strings for JS, JSON, HTML, or SQL. Part of the DevTools Surf developer suite. Browse more tools in the Text / String collection.

Use Cases

• Escaping user input strings before inserting into SQL queries
• Preparing JSON string values containing special characters
• Escaping HTML content for safe JavaScript string embedding
• Sanitizing log messages containing control characters

Tips

• Choose the target language before escaping for correct syntax
• Escape SQL strings to prevent injection in manual queries
• Toggle between escape and unescape modes with one click

Fun Facts

• SQL injection, first documented by Jeff Forristal in Phrack Magazine in 1998, remains in the OWASP Top 10 over 25 years later.
• The backslash escape character was introduced by the C programming language in 1972 and adopted by nearly every language since.
• JSON requires only two characters to be escaped: the backslash and the double quote, plus control characters below U+0020.

FAQ

Which escape formats are supported?

JavaScript, JSON, HTML, SQL, Python, Go, Shell, and CSS. Each has its own escape rules; the tool picks the right one based on your target.

Does it escape or unescape?

Both — toggle direction. Useful for inspecting escape sequences in logs (unescape) or generating embedded literals in source code (escape).

What's the difference between JS and JSON escaping?

JSON is stricter: it requires double quotes, forbids trailing commas, and escapes a smaller character set. JS allows single quotes and a few more unescaped characters (forward slashes, single quotes).

Are unicode characters handled?

Yes — `\uXXXX` and `\x##` escape sequences are produced or consumed based on the target. ASCII-safe mode escapes all non-printable and non-ASCII characters.