String and JSON escape / unescape

Every format has a few characters that would end the string or change its meaning. Escaping replaces just those, so the parser reads them as plain text.

Escaping is not the same as encoding. Escaping keeps the text readable and only marks the dangerous characters; encodings like Base64 turn all of it into a different alphabet. For URLs specifically, the URL decoder also handles + as a space and double-encoded links.

RFC 8259 requires a backslash before " and \, and an escape for the 32 control characters U+0000 to U+001F. Eight short forms exist: \" \\ \/ \b \f \n \r \t. Anything else can be written as \uXXXX with four hex digits. A character outside the Basic Multilingual Plane, like most emoji, takes two of them (a UTF-16 surrogate pair): 😀 is \ud83d\ude00.

JSON has no \', \x41 or \u{1F600}. Those are JavaScript escapes, and a strict JSON parser rejects them. The tool flags them when you unescape.

// JavaScript
JSON.stringify('He said "hi"\n')   // '"He said \\"hi\\"\\n"'
JSON.parse('"caf\\u00e9"')          // 'café'

# Python
json.dumps('He said "hi"\n')       # '"He said \\"hi\\"\\n"'
json.dumps('café', ensure_ascii=False)  # keep non-ASCII as is

// Go
b, _ := json.Marshal("He said \"hi\"")

In HTML text, only & and < must be escaped; inside an attribute value, & and the quote character that wraps the value. Escaping all five (& < > " ') everywhere is the simple, safe habit, and it is what template engines do. On a UTF-8 page you do not need entities for accented letters or emoji; the Other characters option writes them as named, decimal or hex references if your pipeline needs pure ASCII.

XML predefines only < > & ' ". Numeric references work for any allowed character, but control characters other than tab, line feed and carriage return are not allowed in XML 1.0 at all, not even as . The tool warns when your text contains one.

When you unescape HTML, numeric references from 128 to 159 are read the way browsers read them, as Windows-1252 (– is an en dash, not a control character), and named entities beyond the HTML 4 set are resolved by your browser's own parser.

SQL. The standard way is to double the quote: 'O''Brien'. PostgreSQL, SQLite, SQL Server and Oracle work that way. MySQL and MariaDB also read backslash escapes (\' \n \\) unless NO_BACKSLASH_ESCAPES is on; PostgreSQL only does inside E'…' strings. Escaping is for building SQL by hand, like a migration or a one-off query. For user input, use placeholders.

-- one quote doubled
INSERT INTO people (name) VALUES ('O''Brien');

// Node (pg): the driver handles quoting
await client.query('INSERT INTO people (name) VALUES ($1)', ["O'Brien"]);

CSV. RFC 4180 wraps a field in double quotes when it contains the delimiter, a quote or a line break, and doubles any quote inside: "Smith, John ""Johnny""". The tool also quotes fields with leading or trailing spaces, which some spreadsheet apps trim. To convert whole files, use JSON to CSV.

Shell. Inside single quotes nothing is special, so a single quote cannot be escaped there: close the quote, add \', and reopen. Inside double quotes, $, `, " and \ still need a backslash. Bash and zsh's $'…' form reads C-style escapes like \n and \t.

echo 'it'\''s here'          # it's here
printf '%q\n' "it's here"     # bash: it\'s\ here
python3 -c 'import shlex; print(shlex.quote("it'"'"'s here"))'   # 'it'"'"'s here'

To match text literally in a regular expression, escape the 15 metacharacters . * + ? ^ $ { } ( ) | [ ] \. Add / when the pattern goes inside a /…/ literal. Newer JavaScript engines ship RegExp.escape(), which escapes more characters so the result is also safe inside character classes.

const escapeRegExp = s => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
new RegExp(escapeRegExp('$5.00 (approx)')).test('costs $5.00 (approx)')  // true

re.escape('$5.00 (approx)')     # Python
regexp.QuoteMeta("$5.00")       // Go

A JavaScript string escapes only the quote character that delimits it, the backslash and line breaks. In template literals, ` and ${ also need a backslash. Old octal escapes like \101 are a SyntaxError in strict mode and in template literals; the unescaper reads them but warns.

• Putting a code sample, an error message or a whole JSON document inside a JSON field (an API payload, a webhook test, a config value).
• Reading a log line where JSON was serialized twice and every quote shows up as \".
• Showing user text or code in HTML without the browser treating it as markup (XSS starts here).
• Writing a seed file or migration with names like O'Brien.
• Passing a filename with spaces or quotes to a command in a script or a CI step.
• Searching for a literal string like $5.00 or a.b[0] with a regex tool.

To see the code points and bytes behind a strange character, use the Unicode converter. To check a JSON document after escaping, use the JSON formatter. Building an API? Browse API tools on DevHunt.