Shell, Regex, SQL, CSV & JSON String Escape / Unescape
Every language and format has its own rules for quotes and special characters. Convert text for the one you need, in either direction, right in your browser. For HTML and JavaScript strings, use the HTML/JS String Escape tool. For URLs, try the URL Encoder/Decoder.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- The SQL output is for learning and display only. In real applications, never build queries by string concatenation; use placeholders (parameterized queries). Escaping alone does not fully prevent SQL injection.
- The result converts the contents of a string. Shell output is wrapped in single quotes; SQL and JSON output has no surrounding quotes, so add them yourself if you need them.
- Shell escaping targets POSIX sh, bash and zsh. Windows Command Prompt and PowerShell follow different rules.
- SQL dialects differ. Standard SQL, PostgreSQL and SQLite use the '' style, while MySQL also accepts backslash escapes (unless NO_BACKSLASH_ESCAPES is on).
- CSV treats the whole input as a single field. It is wrapped in double quotes only when it contains a comma, a double quote or a line break.
Glossary
Escaping
Rewriting characters that have a special meaning inside a string (quotes, backslashes, regex metacharacters and so on) so they are treated as plain text. The method differs by language and format.
SQL injection
An attack where input is interpreted as part of an SQL statement and runs unintended commands. The reliable defense is to pass values separately from the SQL using placeholders (parameterized queries).
Metacharacter
A character with a special function in a regular expression, such as "." (any character) or "*" (zero or more repeats), rather than standing for itself. Escape it with a backslash to match it literally.
FAQ
Does SQL escaping alone prevent SQL injection?
No. The SQL escaping here is for learning and display. In real applications, do not build SQL by string concatenation; pass values through placeholders (parameterized queries).
What is the difference between the standard and MySQL SQL styles?
Standard SQL writes a single quote as two single quotes (''). MySQL also accepts backslash escapes such as \', \n and \\. Pick the one that matches your database.
Why is the shell output wrapped in single quotes?
Inside single quotes, characters such as $, ` and backslash are all taken literally. A single quote inside the text is written by closing the quote, adding an escaped quote, and reopening: '\''. This targets POSIX-style shells like bash and zsh.
Which characters does regex escaping cover?
It covers . * + ? ^ $ { } ( ) | [ ] \ / and -. Passing the result to new RegExp() gives a pattern that matches the original text literally.
Do I need the surrounding double quotes to unescape a JSON string?
No, either works. If the input is wrapped like "...", the outer quotes are removed before converting. You can also paste just the contents without quotes.
Share this page