String Escaper and Unescaper
Escape text so it can be pasted safely into JSON, HTML, a JavaScript string, a regular expression or a CSV cell, and reverse it.
Escape text for JSON, HTML, JavaScript, a regular expression or a CSV cell, and reverse it.
What this does
Making the text safe to paste inside a JSON string value.
"She said \"hello\" & left.\nLine two <b>bold</b>"About the string escaper and unescaper
Every format has characters it treats specially, and pasting text with one of them in the wrong place is how you get a parse error or, worse, an injection bug. A quote inside a JSON string, an angle bracket inside HTML, a dot inside a regular expression: each needs different handling.
This escapes for the target you pick and reverses it just as easily, so you can also read an escaped string that arrived from somewhere else.
How to use it
- 1Paste your text.
- 2Choose the format you are escaping for.
- 3Pick escape or unescape.
- 4Copy the result.
Questions
Why escape for a regular expression?
Characters like . * + ? and ( are operators. To match a literal dot you need \. instead of ., otherwise the pattern matches any character at all.
Is HTML escaping enough to prevent XSS?
For text placed between tags, escaping these five characters is the right defence. Inside an attribute, a URL or a script block the rules differ, so use your framework's context aware escaping rather than doing it by hand.
What makes a CSV cell need quoting?
A comma, a double quote or a newline. The cell is wrapped in double quotes and any quote inside it is doubled.
Does JSON escaping handle unicode?
Yes. It uses the browser's own JSON encoder, so emoji and non-Latin scripts are handled correctly.