What is the difference between JSON and JavaScript escaping?

JSON only allows \" \\ \/ \b \f \n \r \t and \uXXXX, and strings must use double quotes. JavaScript also has single-quoted and template strings plus \x, \v, \0 and \u{…}. U+2028 and U+2029 were line terminators in older JavaScript, so JS mode writes them as \u escapes.

Does SQL escaping prevent SQL injection?

Doubling single quotes makes a standard SQL string literal safe, but databases, character sets and SQL modes have edge cases. In application code always use parameterized queries (prepared statements); this escaping is meant for hand-written SQL, test data and debugging.

Why does shell escaping use single quotes?

Inside bash single quotes every character — $, backticks, backslashes, line breaks — is literal except the single quote itself, which becomes '\''. That makes it the safest quoting style. Text made only of letters, digits and safe characters like -_./:= is left unquoted.

What does “unrecognized escape” mean when unescaping?

The input contains a backslash sequence the language does not define, such as \a or \x41 in JSON. Strict formats like JSON and Java keep it as is and warn you, Python keeps the backslash just like the interpreter, and JavaScript drops the extra backslash per the spec. Try another language, or check whether the text was escaped twice.

🧶

🧶String Escape & Unescape: JSON, JS, Java, Python, SQL, Bash

Quotes, backslashes, line breaks and special characters are what usually break when you paste text into code, config files or commands. Pick the target language, type the raw text and get a result you can paste straight in — or go the other way and turn an escaped string from a log or network capture back into plain text. Supported formats are JSON (RFC 8259), JavaScript single-quoted, double-quoted and template literals (backticks and ${ escaped, U+2028/2029 handled), Java, C#, C/C++ (octal control characters, UTF-8 byte escapes, no trigraphs), Go, Python, standard SQL quotes, SQL LIKE wildcards, bash-safe single quoting, regex metacharacters, CSV fields, XML / HTML attributes and URL encoding. Options escape non-ASCII characters such as accents, CJK and emoji as \u sequences, wrap the output in quotes, or treat each line as its own string. Unescaping strips surrounding quotes automatically, understands \x, \u, \U, \u{…} and octal forms, and warns about escapes the language does not recognise. The change view highlights every replaced character, with the before and after shown on hover.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use String Escape / Unescape

1Choose Escape or Unescape and the target language or format
2Type or paste text and toggle non-ASCII escaping, quotes or line-by-line mode
3Copy the result or review the highlighted changes

FAQ

What is the difference between JSON and JavaScript escaping?: JSON only allows \" \\ \/ \b \f \n \r \t and \uXXXX, and strings must use double quotes. JavaScript also has single-quoted and template strings plus \x, \v, \0 and \u{…}. U+2028 and U+2029 were line terminators in older JavaScript, so JS mode writes them as \u escapes.
Does SQL escaping prevent SQL injection?: Doubling single quotes makes a standard SQL string literal safe, but databases, character sets and SQL modes have edge cases. In application code always use parameterized queries (prepared statements); this escaping is meant for hand-written SQL, test data and debugging.
Why does shell escaping use single quotes?: Inside bash single quotes every character — $, backticks, backslashes, line breaks — is literal except the single quote itself, which becomes '\''. That makes it the safest quoting style. Text made only of letters, digits and safe characters like -_./:= is left unquoted.
What does “unrecognized escape” mean when unescaping?: The input contains a backslash sequence the language does not define, such as \a or \x41 in JSON. Strict formats like JSON and Java keep it as is and warn you, Python keeps the backslash just like the interpreter, and JavaScript drops the extra backslash per the spec. Try another language, or check whether the text was escaped twice.