Smart String Escaper & Unescaper (JSON, HTML, JS, SQL, Unicode)
Bidirectional escaping and unescaping tool for JSON, HTML Entities, JavaScript, SQL strings, and Unicode characters.
How do I use Smart String Escaper & Unescaper (JSON, HTML, JS, SQL, Unicode)?
Select your target context (JSON, JavaScript, HTML Entities, URL Component, SQL String, or CSV Field) and mode (Escape vs Unescape).
Paste your raw string into the left editor or click 'Sample' to load a string containing quotes, newlines, and symbols.
Copy the escaped or unescaped output from the right editor directly into your code.
What features does Smart String Escaper & Unescaper (JSON, HTML, JS, SQL, Unicode) offer?
Bidirectional Escape & Unescape modes
Supports JSON, HTML Entities, JavaScript, SQL, and Unicode
Swap input & output workspace button
100% client-side local browser execution
Cross-Language String Escaping & Injection Prevention Rules
Each serialization format and query language defines its own metacharacters and escape sequences. Using backslash escaping in SQL or CSV instead of doubling quotes causes syntax errors or injection vulnerabilities.
| Format / Context | Quote / Delimiter | Escape Mechanism | Example Escaped Output |
|---|---|---|---|
| JSON / JavaScript | Double quote (") | Backslash (\", \\, \n, \t) | "Line 1\n\"Quoted\"" |
| HTML5 Entities | <, >, &, ", ' | Named character references | <script>&" |
| ANSI SQL Literal | Single quote (') | Double the single quote ('') | 'O''Reilly Media' |
| RFC 4180 CSV Cell | Double quote (") | Enclose in " and double internal "" | "15"" Display, 4K" |
Frequently Asked Questions about Smart String Escaper & Unescaper (JSON, HTML, JS, SQL, Unicode)
Why does ANSI SQL escape single quotes by doubling them (`''`) instead of using `\'`?
Standard ANSI SQL (PostgreSQL, SQLite, SQL Server, Oracle) treats backslashes as literal characters and requires doubling single quotes (`'O''Reilly'`). Only MySQL with `NO_BACKSLASH_ESCAPES` disabled accepts `\'`, so `''` is the portable standard.
Why must I escape all 5 characters (`&`, `<`, `>`, `"`, `'`) to prevent HTML XSS?
Escaping only `<` and `>` leaves HTML attributes vulnerable if user input is placed inside `value="..."` or `value='...'`. Escaping `"` as `"` and `'` as `'` prevents breaking out of attribute contexts.
What is the difference between JSON escaping and JavaScript string escaping?
JSON is stricter than JavaScript: JSON forbids single-quoted strings, trailing line-continuation backslashes, and ` ` or ` ` escapes, requiring 4-digit hex Unicode escapes (`\u0000`) for control characters.
How does URL Component escaping handle spaces and plus (`+`) signs?
URL mode uses `encodeURIComponent()`, which encodes spaces as `%20` and plus signs as `%2B` in strict compliance with RFC 3986.
Explore Related Developer Tools
URL Encoder / Decoder
Encode and decode URL strings with encodeURIComponent, encodeURI, and Base64URL modes.
Mock Data Generator
Generate realistic fake data for testing: JSON, CSV, SQL, XML with 50+ field types — names, emails, UUIDs, dates, addresses. Runs 100% in your browser via Web Worker.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 strings back to text. Supports Unicode UTF-8 and URL-Safe modes.
CSV to JSON Converter
Convert CSV spreadsheets and delimited text into structured JSON arrays with auto-delimiter and dynamic data type detection.
JSON to CSV Converter
Convert JSON object arrays into RFC 4180 compliant CSV spreadsheets ready for Excel, Google Sheets, and SQL imports.
HTML to React JSX
Transform raw HTML snippets into valid React JSX/TSX components. Auto-converts class to className and style objects.