String Escape / Unescape Developer Tool
Escape or unescape a string for JSON, SQL, or POSIX shell.
Pasting a raw string containing quotes, backslashes, or newlines directly into a JSON literal, a SQL statement, or a shell command is a reliable way to break the syntax or open an injection hole. This free string escape tool is a developer tool that escapes and unescapes text for JSON, SQL, and POSIX shell, entirely in your browser.
Input
Output
Runs entirely in your browser — no data is sent anywhere.
Three targets, three escaping rules
Each destination format has its own rules for what needs escaping and how. JSON string escaping wraps the result in double quotes and backslash-escapes double quotes, backslashes, and control characters like newline and tab, using the same rules JavaScript's JSON.stringify follows — this is what you need when hand-building a JSON payload rather than letting a library serialise it for you. SQL escaping in standard mode doubles up single quotes (it's becomes it''s), which is the ANSI-standard way to embed a literal quote inside a SQL string literal; the MySQL-style option instead backslash-escapes quotes and control characters, matching MySQL's non-standard (but very common) default sql_mode. POSIX shell escaping wraps the string in single quotes and handles any embedded single quote with the '\'' idiom — close the quote, insert an escaped literal quote, reopen the quote — since single-quoted shell strings otherwise can't contain a single quote at all.
Escaping is not a substitute for parameterized queries
SQL escaping shown here is useful for quickly sanity-checking what an escaped literal looks like, or for generating a one-off migration or seed script by hand — it is not a recommended way to build queries in application code. A Laravel query builder or Eloquent call parameterises values automatically via prepared statements, which is safe against SQL injection in a way that string escaping, done by hand, is not guaranteed to be for every edge case and character encoding.
Why shell escaping looks so different
Unlike JSON or SQL, POSIX shells have no backslash-escape mechanism inside single quotes at all — a backslash inside single quotes is literal, not an escape character. That's why the standard technique for embedding a literal single quote is the slightly odd-looking close-escape-reopen sequence rather than a simple backslash prefix. Getting this wrong is a common source of shell injection vulnerabilities in scripts that build commands from untrusted input by string concatenation instead of using an array-based exec call.
Related tools
For structured JSON rather than a single escaped string, the JSON viewer handles formatting and validation. When the target is HTML markup instead of JSON, SQL, or shell, use the HTML entity encoder instead — and for binary-safe embedding of arbitrary bytes as text, Base64 encoding sidesteps escaping rules entirely.