String Escape & Unescape — JSON, XML, HTML, SQL, URL
What does escaping do?
Every text-based format has characters with reserved meaning — quotes in JSON, angle brackets in HTML and XML, single quotes in SQL literals, percent signs in URLs. Escaping replaces those characters with safe equivalents so the string parses as data instead of being interpreted as markup or syntax. Picking the wrong escape format is how bugs and injection vulnerabilities slip in.
How to use
- Pick Escape or Unescape.
- Choose the target format: JSON, XML, HTML, SQL, or URL.
- Type or paste your string — conversion happens in real time.
- Press Sample to load a format-specific example.
- Press Swap to feed the output back into the input.
Frequently Asked Questions
Which format should I pick?
Match the format to where the string will end up. Embedding a value in a JSON payload? Use JSON. Putting it inside an XML attribute? Use XML. Rendering inside an HTML page? Use HTML. Building a SQL literal (only when parameterized queries aren't an option)? Use SQL. Sending it as part of a URL query parameter? Use URL.
What's the difference between JSON and HTML escaping?
JSON escapes characters that would break the JSON syntax — quotes, backslashes, control characters — using backslash sequences like \" and \n. HTML escapes characters that would be parsed as markup — <, >, &, and quotes — using named or numeric entities like < and &. The two are not interchangeable: pasting JSON-escaped text into HTML still leaves you open to XSS.
Is SQL escaping enough to prevent SQL injection?
No. SQL escaping (doubling single quotes, escaping backslashes) covers the common cases but databases differ in edge cases — encoding, comment syntax, NULL bytes. Parameterized queries (prepared statements) are the only reliable defense. Use this tool to inspect or build literals during development, not as a production injection guard.
Why does the JSON escape mode keep the input on one line?
JSON escape produces the string contents of a JSON value — newlines become \n, tabs become \t, quotes become \". The result is what you'd put inside the double quotes of a JSON string. If you want the full JSON string literal, wrap the result in quotes yourself.
Does this tool send my data to a server?
No. All escape and unescape conversions run in your browser using JavaScript. Your input never leaves your device.