TinySandyFree Online Tools

String Escaper

Get text into a form that can be pasted safely between quotes in code or data files. Pick the target format and the result updates as you type: quotes, backslashes, line breaks and control characters are escaped according to that format's rules. Switch to Unescape to turn an escaped literal back into plain text.

Encoding & Security Runs in your browser

Escape or Unescape a String

Direction
For CSV this forces quoting.

How to Use the String Escaper

  1. Choose Escape or Unescape.
  2. Pick the format, and tick Add surrounding quotes if you want them.
  3. Type or paste the text; the result appears below.
  4. Copy the result.

About This Tool

Developers embedding text in source code, JSON fixtures or SQL scripts, and anyone cleaning up escaped strings copied from logs.

Input: Text  ·  Output: Escaped text.

Features and Limitations

Features

  • Eight targets including template literals and both SQL quoting styles.
  • Unescaping uses careful hand-written parsers with clear error positions, never eval.
  • Handles control characters, NUL, and the U+2028/U+2029 separators that break older JavaScript.
  • Warns about spreadsheet formula injection for CSV values.

Limitations

  • SQL escaping is not a substitute for parameterised queries.
  • HTML escaping here is for attribute values and text, not for building trusted HTML from user input.
  • Legacy JavaScript octal escapes such as \101 are not decoded.
  • Results are computed in your browser; nothing you enter is sent to a server.

Example

Escaping She said "hi" for JSON gives She said \"hi\"; for a standard SQL literal O'Brien becomes O''Brien.

Frequently Asked Questions

What is the difference between JSON and JavaScript escaping?

JSON only allows double-quoted strings and a fixed set of escapes. JavaScript also has single quotes, template literals and \x / \u{…} escapes.

Should I escape SQL values myself?

Prefer prepared statements with placeholders. Use escaping for hand-written scripts, migrations and test data.

Why does MySQL need a separate option?

MySQL treats backslash as an escape character in strings by default, so backslashes and quotes are escaped differently than in standard SQL.

Is my text processed on a server?

No. Everything happens in your browser.

Related Tools

More like this: all Encoding & Security tools, all Developer & Web tools or the TinySandy home page.