Special characters break code. A stray quote inside a JSON string, an apostrophe in a SQL value, or an angle bracket in HTML can cause errors or worse. String escaping solves this by converting those characters into a safe form. Our free escape and unescape tool handles JSON, JavaScript, SQL, HTML, and regex in your browser.
What Is String Escaping?
Escaping means replacing characters that have special meaning in a given context with a safe representation. For example, a double quote inside a JSON string is escaped as \" so the parser knows it is part of the text, not the end of the string. Unescaping reverses the process, turning the escaped form back into the original characters.
Escaping by Language
Different languages and formats use different escaping rules:
JSON — Escapes quotes, backslashes, and control characters. Essential when embedding text inside a JSON value.
JavaScript — Similar to JSON, with escapes for quotes, newlines (\n), tabs (\t), and Unicode sequences.
SQL — Escapes single quotes by doubling them (''), which prevents both errors and SQL injection in string literals.
HTML — Converts <, >, &, and quotes into entities like <, >, and & so they display as text instead of being interpreted as markup.
RegEx — Escapes characters with special meaning (., *, +, ?, brackets) so they match literally.
How to Escape a String Online
- Choose the target language — JSON, JavaScript, SQL, HTML, or regex.
- Select Escape or Unescape.
- Paste your text and see the converted result instantly.
- Copy it into your code.
Why Escaping Matters for Security
Beyond preventing bugs, proper escaping is a core defence against injection attacks. Unescaped user input in a SQL query enables SQL injection; unescaped input in a web page enables cross-site scripting (XSS). Escaping input for its destination context neutralises these characters so they are treated as harmless data rather than executable code.
Frequently Asked Questions
Is the escape tool free? Yes — it is free, requires no sign-up, and runs entirely in your browser.
Which languages does it support? JSON, JavaScript, SQL, HTML, and regular expressions, with both escape and unescape directions.
What does escaping a string do? It converts characters that have special meaning — like quotes, backslashes, or angle brackets — into a safe form so they are treated as literal text.
Is my text uploaded anywhere? No. All escaping happens locally in your browser.
Need to safely embed text in code? Paste it and escape it for your target language in seconds.