What escaping does
Many formats give some characters a special meaning. In HTML, < starts a tag; in a JavaScript or JSON string, " ends the string. To include those characters as plain text, they have to be written another way: escaped. Unescaping reverses it, turning < back into < or\n back into a line break.
How to use it
- Choose the format you are writing for, and whether to escape or unescape.
- Type or paste your text. The result updates as you type.
- Use Swap to move the result into the input and switch direction, which is a quick way to check that text survives a round trip.
The formats
| Format | Escaping | Unescaping |
|---|---|---|
| HTML | & < > " ' become & < > " '. Optionally, every non-ASCII character becomes a numeric reference such as é. | All 2,125 named references in the HTML standard, such as é and ≂̸, plus decimal and hex references. |
| XML | The five predefined entities: & < > " '. | Those five plus numeric references. Anything else, such as , is an error, because XML only knows names its document defines. |
| JavaScript string | Backslashes, the chosen quote, line breaks, tabs, control characters and broken characters, plus ${ in template literals. | Every escape JavaScript has: \n \t \x41 \u0041 \u{1F600}, line continuations and old-style octal. |
| JSON string | Exactly what JSON.stringify produces. | Strict JSON rules: only \" \\ \/ \b \f \n \r \t and \uXXXX, with no raw line breaks or tabs. |
| Unicode escapes | Non-ASCII characters (or everything) as \uXXXX, \u{…}, U+XXXX or &#x…;. | Any mix of \uXXXX, \u{…}, \UXXXXXXXX, U+XXXX and numeric references. Other text is left alone. |
| Regular expression | Puts a backslash before \ ^ $ . * + ? ( ) [ ] { } | /, so a pattern matches the text literally. | Turns an escaped pattern back into text, if it only matches fixed text. |
| CSV field | Adds quotes when the value contains the separator, a quote, a line break or spaces at either end, and doubles any quotes. | Removes the quotes and halves doubled quotes. |
| SQL string | Doubles single quotes, as standard SQL requires. Optionally doubles backslashes for MySQL and MariaDB. | Halves doubled quotes, and optionally reads MySQL backslash escapes. |
Rules worth knowing
- HTML references without a semicolon, such as
©2026, are decoded the way browsers do in page text: the old names that work without a semicolon (&,©and about 100 others) are recognised, and others are left unchanged. Browsers are stricter inside attribute values. - Numeric references follow the HTML standard too. For example,
–becomes an en dash (–), because browsers read 128–159 as Windows-1252 characters, and�becomes the replacement character (�). - Include surrounding quotes adds quotes when escaping. When unescaping, it expects the input to start and end with a quote, and reports a quote in the middle that would end the string early.
- Regular expressions only unescape when the pattern matches fixed text. A pattern with an operator such as
*, or a class such as\d, describes many possible texts, so it can’t be turned back into one.
Limitations
- CSV works on a single field (one value), so the whole input is treated as one value. To convert whole rows or files, use the JSON, YAML and CSV converter.
- SQL escaping is for queries you run by hand. In code, always use parameterised queries instead.
- Unicode unescaping decodes anything that looks like an escape, so text that already contains
U+0041or\u0041as written examples will be changed too. - Input is limited to 2 million characters.
Frequently asked questions
What is the difference between escaping and encoding?
The words are often used for the same thing. Escaping usually means rewriting the few characters that have a special meaning in one place, such as < in HTML or " in a JSON string, so they are read as plain text. Encoding often means converting all the text into another form, such as Base64 or percent-encoding for URLs. Both can be reversed, and neither hides anything.
Is escaping text for HTML enough to stop cross-site scripting (XSS)?
Escaping & < > " ' makes text safe to place between tags and inside quoted attribute values. It is not enough inside <script> or <style> blocks, unquoted attributes, or URLs such as href, where a javascript: link needs no special characters at all. In real applications, use your framework’s templating, which escapes for the right context automatically.
Why does the HTML escape use ' instead of '?
' was added in HTML5 and XHTML, so some older browsers and email programs do not recognise it. ' means the same character and works everywhere. The XML option uses ', which XML has always had.
Should I escape strings myself when writing SQL?
Not in application code. Use parameterised queries (also called prepared statements or bind variables), where the database receives the values separately from the query and nothing needs escaping. Escaping by hand is easy to get wrong, depends on database settings, and is the cause of many SQL injection attacks. This option is for one-off queries you write and run yourself.