For a JavaScript literal between quotes. If that code goes inside an HTML attribute (onclick="…"), it must also be escaped for HTML, in that order.
How to use
What it is and what it's for
Drop any text inside a code string without breaking it. Every language or format reserves certain characters (quotes, backslashes, <, &…); if your text contains them, you must escape them —swap them for a safe sequence— so they are treated as text, not as syntax. This tool escapes and unescapes for 7 different targets, 100% in your browser: nothing is uploaded to any server.
How to use it (step by step)
1. Pick the mode (the target format: JavaScript, JSON, SQL…).
2. Pick the direction: Escape or Unescape.
3. Paste your text into «Input text».
4. The Result shows below instantly; press the copy icon to grab it.
Changing mode or direction recomputes right away over the same text.
JavaScript mode
Prepares text for a JavaScript/TypeScript string. Escapes the backslash (\ → \\), the newline (→ \n), the carriage return (→ \r), the tab (→ \t), the null character (→ \0), the three quotes (", ' and `), $
JSON mode
Builds the contents of a JSON string (without the outer quotes) via JSON.stringify. Escapes double quotes (→ \"), backslashes (→ \\) and every control character as a valid JSON sequence: newline → \n, tab → \t, return → \r, and others like \u001b. Wrap the result in double quotes and you have a valid JSON value.
Example: Ann said "yes" → Ann said \"yes\".
SQL mode
Escapes strings for standard SQL by doubling the single quote (' → ''), which is how SQL represents a literal quote inside '...'. It stops an apostrophe from closing the string early (a classic cause of syntax errors and SQL injection). It does not escape the backslash: standard SQL does not treat it as an escape character, but MySQL and MariaDB do (unless NO_BACKSLASH_ESCAPES), and there this escape is not enough.
Escaping is not the defence against SQL injection. A parameterised query is: the value travels separately and is never interpreted as SQL.
Example: O'Brien → O''Brien.
Regex mode
Turns your text into a pattern matched literally. It prepends a backslash to the regular-expression metacharacters —. \ + * ? [ ] ^ $ ( )
HTML mode
Escapes text so you can drop it inside HTML without the browser reading it as tags. Converts & → &, < → <, > → >, " → " and ' → '. Prevents XSS and keeps your content from breaking the page markup.
Example: <a href="x"> → <a href="x">.
URL mode
Encodes text for a URL with encodeURIComponent: replaces unsafe characters with their %XX form. A space becomes %20, & becomes %26, = becomes %3D, and so on. Use it to put a value into a query parameter without breaking the URL. When unescaping, if the input is malformed it returns the text as-is without throwing.
Example: a b&c=d → a%20b%26c%3Dd.
CSS mode
Escapes text to use as a CSS identifier or value (for example inside a selector). It follows the CSS.escape algorithm: a backslash before punctuation, and a hexadecimal escape for control characters and for a leading digit (an id like 1col is not a valid selector without it).
Example: #main .box:hover → \#main\ \.box\:hover; 1col → \31 col.
Escape, unescape and notes
Escape turns the original text into its escaped version; Unescape does the reverse and recovers the original.
• Use the same mode to unescape that you used to escape.
• URL and JSON do not throw if the input is malformed: they return the text as-is.
• The result is computed automatically and saved; you can copy, export the text or import it from the toolbar.
