Which escape formats are supported?

JavaScript, JSON, HTML, SQL, Python, Go, Shell, and CSS. Each has its own escape rules; the tool picks the right one based on your target.

Does it escape or unescape?

Both — toggle direction. Useful for inspecting escape sequences in logs (unescape) or generating embedded literals in source code (escape).

What's the difference between JS and JSON escaping?

JSON is stricter: it requires double quotes, forbids trailing commas, and escapes a smaller character set. JS allows single quotes and a few more unescaped characters (forward slashes, single quotes).

Are unicode characters handled?

Yes — `\uXXXX` and `\x##` escape sequences are produced or consumed based on the target. ASCII-safe mode escapes all non-printable and non-ASCII characters.

String Escape / Unescape

DevTools Surf

Example: String Escape / Unescape

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

He said "Hello, World!" and then
	tabbed over.
Path: C:\Users\john\docs

Output

=== JSON/JS String ===
"He said \"Hello, World!\" and then\n\ttabbed over.\nPath: C:\\Users\\john\\docs"

=== HTML Escaped ===
He said &quot;Hello, World!&quot; and then
	tabbed over.
Path: C:\Users\john\docs

=== URL Encoded ===
He%20said%20%22Hello%2C%20World!%22%20and%20then%0A%09tabbed%20over.%0APath%3A%20C%3A%5CUsers%5Cjohn%5Cdocs

=== Unicode Escaped ===
He said "Hello, World!" and then
	tabbed over.
Path: C:\Users\john\docs

About String Escape / Unescape

String Escape / Unescape preview - Text / String tool

Escape and unescape strings for JS, JSON, HTML, or SQL. Part of the DevTools Surf developer suite. Browse more tools in the Text / String collection.

Use Cases

Escaping user input strings before inserting into SQL queries
Preparing JSON string values containing special characters
Escaping HTML content for safe JavaScript string embedding
Sanitizing log messages containing control characters

Tips

Choose the target language before escaping for correct syntax
Escape SQL strings to prevent injection in manual queries
Toggle between escape and unescape modes with one click

Fun Facts

SQL injection, first documented by Jeff Forristal in Phrack Magazine in 1998, remains in the OWASP Top 10 over 25 years later.
The backslash escape character was introduced by the C programming language in 1972 and adopted by nearly every language since.
JSON requires only two characters to be escaped: the backslash and the double quote, plus control characters below U+0020.

FAQ

Which escape formats are supported?: JavaScript, JSON, HTML, SQL, Python, Go, Shell, and CSS. Each has its own escape rules; the tool picks the right one based on your target.
Does it escape or unescape?: Both — toggle direction. Useful for inspecting escape sequences in logs (unescape) or generating embedded literals in source code (escape).
What's the difference between JS and JSON escaping?: JSON is stricter: it requires double quotes, forbids trailing commas, and escapes a smaller character set. JS allows single quotes and a few more unescaped characters (forward slashes, single quotes).
Are unicode characters handled?: Yes — `\uXXXX` and `\x##` escape sequences are produced or consumed based on the target. ASCII-safe mode escapes all non-printable and non-ASCII characters.

Related Text / String Tools

URL Encoder URL Decoder HTML Entity Encode HTML Entity Decode JWT Decoder Lorem Ipsum Generator Word Counter Text Diff