DevKitHub

Encoding & Conversion

Escape and Unescape Text — JSON, JavaScript, Regex, Shell, SQL

Paste text to escape it for a JSON or JavaScript string, a regular expression, a shell argument or a SQL literal. JSON and JavaScript can be unescaped again.

1 line
1 line

This tool runs entirely in your browser. Your input is never uploaded, stored or logged.

How it works

Each target has its own rules, and the interesting ones are the cases that look like they already work. U+2028 and U+2029 are ordinary characters in JSON and line terminators inside a JavaScript string literal, so valid JSON containing one becomes a syntax error the moment it is embedded in a script tag. That was a long-lived production bug in a great many sites, fixed in the language only in ES2019 and still present anywhere the JSON is pasted into a template. Both targets escape them, and the escaped form is still valid JSON.

An unpaired surrogate is escaped too. JavaScript strings permit one, JSON has no way to represent it, and passing it through produces output that is not well-formed UTF-8 — so it is escaped and said out loud rather than silently corrupting the result. A valid surrogate pair, such as an emoji, is left intact.

Shell escaping wraps the value in single quotes and writes a closed-escaped-reopened sequence for an embedded quote, which is the only form that leaves no metacharacter live inside it. SQL escaping doubles the quote and carries a warning, because doubling a quote is not what makes a query safe — a parameterised query is. Unescaping is offered for JSON and JavaScript only: for a regex, a shell argument or a SQL literal a backslash may be an escape or a literal backslash, and guessing would change the text without saying so.

Common problems

Every example below is run against this tool in our test suite, so what it says here is what the tool actually does.

That is not a valid escape in a JSON string.

\q
Why:
JSON defines a closed set of escapes — quote, backslash, slash, b, f, n, r, t and \u. Anything else after a backslash is a syntax error rather than a literal character.
Fix:
Escape the backslash itself as \\ if you meant a literal one.

\u must be followed by four hex digits.

\u00
Why:
A \u escape is exactly four hex digits with no variable length form. A truncated one is usually the result of a string being cut at a fixed byte count.
Fix:
Write the full four digits, such as \u00e9, or check whether something upstream truncated the string.

Valid JSON breaks the page when embedded in a script tag.

Why:
The data contains U+2028 or U+2029. They are legal unescaped in JSON and are line terminators inside a JavaScript string literal, so the browser sees an unterminated string.
Fix:
Escape them, which this tool does by default. The output is still valid JSON and is safe to embed.

Frequently asked questions

Why escape U+2028 when JSON allows it?
Because JavaScript does not. It is a line terminator inside a string literal, so JSON containing it is a syntax error once embedded in a script tag. The escaped form is still valid JSON, so escaping costs nothing and removes the trap.
Is SQL escaping enough to prevent injection?
No. Use a parameterised query or a prepared statement. This is for a literal you are writing by hand, such as a one-off migration, and it warns you every time for that reason.
Why can I not unescape a regex or a shell argument?
Because the mapping is not one-to-one. A backslash before a non-metacharacter could be a literal backslash or a redundant escape, and there is no way to tell which. Guessing would change your text without saying so, so it refuses instead.

Related tools

Last updated