String Escape & Unescape

Escape and unescape strings for JavaScript, JSON, HTML, SQL, and regex. Handle special characters safely.

Free Always No Account Needed 100% Client-Side

About this tool

Special characters in strings can cause syntax errors, security vulnerabilities, or unexpected behavior if not properly escaped. This tool handles escaping for multiple contexts.

JavaScript escaping: Backslash-escape characters that would break a JS string literal (\n, \t, \\, \', \").

JSON escaping: Escape a raw string so it can safely appear as a JSON string value. Handles all JSON escape sequences.

HTML escaping: Convert < > & " ' to HTML entities for safe display in HTML documents.

SQL escaping: Escape single quotes for SQL string literals (never use this as the sole protection — use parameterized queries).

RegEx escaping: Escape metacharacters so a string can be used as a literal pattern in a regular expression.

URL escaping: Same as URL encoding — see the URL Encoder/Decoder tool for full URL parsing.

Frequently Asked Questions

When do I need to escape a string?
Whenever you embed a string into another context that has its own syntax: putting text in an HTML attribute, a JSON value, a SQL query, etc.
What is a newline escape sequence?
\n represents a newline character (line feed). Other common sequences: \t (tab), \r (carriage return), \\ (backslash).
Is SQL escaping safe for preventing SQL injection?
No — always use parameterized queries/prepared statements. String escaping alone is not sufficient for SQL security.
What characters need to be escaped in regex?
. * + ? ^ $ { } [ ] | ( ) \ — these are all metacharacters with special meaning in regex.

Related Tools