String Escape & Unescape Online

String escaping is the practice of converting special characters within a string into alternate representations called escape sequences so that those characters are treated as literal data rather than syntax elements. You need escaping whenever you embed a string inside a context that assigns special meaning to certain characters. For example, a double quote inside a JavaScript string literal would prematurely terminate the string unless it is escaped as \". Similarly, an angle bracket inside HTML content would be interpreted as the start of a tag unless it is escaped as <. Without proper escaping, your code can produce syntax errors, your data formats can become malformed, and your applications can become vulnerable to injection attacks. This tool makes it easy to see exactly how a string should look after escaping for any of eight common formats.

XSS attacks exploit the failure to escape user-supplied content before inserting it into an HTML page. When a web application renders untrusted input without escaping, an attacker can inject malicious markup such as script elements that execute arbitrary JavaScript in other users' browsers. Escaping prevents this by converting characters that have special meaning in HTML into their entity-encoded equivalents. The less-than sign becomes <, the greater-than sign becomes >, the ampersand becomes &, and quotes become " or '. After escaping, the browser renders these characters as visible text rather than interpreting them as HTML syntax, which completely neutralizes the injected payload. Modern web frameworks typically apply output escaping by default, but developers still need to understand the underlying mechanism to handle edge cases and raw rendering contexts correctly.

SQL injection is an attack technique in which malicious SQL code is inserted into a query through unvalidated user input. If an application constructs SQL queries by concatenating strings directly from user input without escaping, an attacker can insert characters such as single quotes to break out of a string literal and modify the query's behavior. For example, entering ' OR '1'='1 into a login field could bypass authentication if the input is not escaped. Escaping the single quote by doubling it ('') prevents the attacker's input from terminating the SQL string literal. While parameterized queries (also known as prepared statements) are the gold-standard defense against SQL injection, proper string escaping provides an additional layer of safety and is essential when working with dynamic SQL, stored procedures, or legacy systems that do not support parameterized queries.

In JavaScript and JSON, the backslash character (\) serves as the escape prefix. When the parser encounters a backslash, it treats the following character as part of an escape sequence rather than as a literal character. The most common sequences are \n for a newline (line feed), \t for a horizontal tab, \r for a carriage return, \\ for a literal backslash, \" for a double quote inside a double-quoted string, and \' for a single quote inside a single-quoted string. JSON additionally uses \uXXXX notation (where XXXX is a four-digit hexadecimal code point) to represent any Unicode character, and it requires all control characters (code points below U+0020) to be escaped. JavaScript supports the same \uXXXX syntax and also provides \xHH for two-digit hexadecimal escapes and \0 for the null character.

Unicode escape sequences represent characters using their numeric code points rather than their literal glyphs. In JavaScript and JSON, the syntax is \uXXXX, where XXXX is a four-digit hexadecimal number corresponding to the Unicode code point. For example, \u00A9 represents the copyright symbol and \u2603 represents the snowman character. In Python, the same \uXXXX syntax is used within regular strings, and \UXXXXXXXX (eight hex digits) handles characters outside the Basic Multilingual Plane. Unicode escapes are useful when your source file encoding might not support certain characters, when you need to embed invisible or non-printable characters in a human-readable way, or when a data format specification requires that non-ASCII characters be escaped. JSON, for instance, technically allows non-ASCII characters in strings, but many JSON producers escape them for maximum interoperability with systems that might not handle UTF-8 correctly.

Escaping and encoding are related but distinct concepts. Escaping replaces specific characters that have special meaning in a given context with alternative representations that are safe within that context, such as replacing " with \" in JavaScript or < with < in HTML. The goal of escaping is to preserve the literal meaning of those characters while preventing them from being interpreted as syntax. Encoding, on the other hand, transforms data from one representation to another, typically changing the format of every byte in the input. Base64 encoding, for example, converts binary data into a sequence of ASCII characters so that it can be transmitted through text-only channels. URL encoding (percent-encoding) replaces unsafe characters with percent signs followed by hexadecimal values. The key distinction is that escaping is context-specific and targets only special characters, while encoding is a systematic transformation of the entire data.

CSV (Comma-Separated Values) escaping follows the rules defined in RFC 4180. A field value must be enclosed in double quotes if it contains any of three special characters: a comma (the field separator), a double quote, or a newline character (either carriage return or line feed). When a field is quoted, any double quote character within the field is escaped by doubling it — so a single " becomes "". For example, the value She said "hello" becomes "She said ""hello""" in a CSV file. Fields that do not contain any special characters can optionally be left unquoted for brevity. This escaping mechanism ensures that CSV parsers can correctly identify field boundaries regardless of the content within each field. When using this tool, the CSV escape mode automatically wraps the input in double quotes and doubles any internal double quote characters.