b2KIT

String Escape / Unescape

Escape and unescape strings for JSON, HTML, XML, JavaScript, CSV, SQL, and regex contexts.

Tested tool guide Tested browser tools Checked August 16, 2026

What String Escape / Unescape does, with a checked example

String Escape / Unescape rewrites pasted text for one selected destination: JSON, HTML, XML, JavaScript, CSV, SQL, or a regular expression. In escape mode, characters that carry syntactic meaning in that destination are replaced with its escaped form. Unescape mode converts recognized forms back to characters. The important trap is treating escaping as universal. The same quote, backslash, ampersand, or newline can require different notation in different contexts, so output from one mode should not be reused in another without review.

Worked example

A concrete input and expected output from the current implementation.

Input

Tom & Jerry

Expected output

Tom & Jerry

With HTML escape selected, the literal ampersand becomes the `&` character reference. The letters and spaces remain unchanged.

How the result is produced

1

Context-specific substitutions

Each mode applies the notation of its selected context. HTML and XML represent markup-sensitive characters with character references. JSON and JavaScript use backslash escape forms inside strings. CSV represents an embedded double quote by doubling it within a quoted field, standard SQL string literals double embedded apostrophes, and regex patterns backslash-escape metacharacters.

2

Reverse conversion

Unescape interprets only the forms recognized by the selected context and converts them back to literal characters. It operates on string content rather than validating an entire document or program. Unescaping a JSON fragment does not parse a JSON object, and processing CSV text does not verify column counts or the structure of surrounding records.

Good uses

  • Preparing a message containing quotes, backslashes, tabs, or line breaks for insertion into a JSON string value.
  • Turning visible HTML or XML markup into text that can appear without being interpreted as elements.
  • Escaping user-supplied literal text before placing it into a regular expression pattern, then inspecting the resulting metacharacter escapes.

Limits and checks

  • The result is escaped content, not proof that the surrounding JSON, JavaScript, HTML, XML, CSV, SQL, or regex is valid.
  • SQL behavior varies by database dialect and settings. Escaped output is not a substitute for parameterized queries, especially with untrusted input.
  • Regex engines, literal delimiters, and replacement-string grammars differ. Escaping pattern text is not the same operation as escaping replacement text.

Common questions

Can I use SQL-escaped output instead of query parameters?

No. SQL mode can apply a string-literal quoting convention, but it does not know the target database, connection settings, statement structure, or value type. Bound parameters keep data separate from SQL syntax and remain the appropriate choice for executing queries, particularly when values originate outside the application.

Why does unescaping with another mode produce a different result?

Unescape is context-specific. `&` is meaningful in HTML and XML, `\n` is a string escape in JSON and JavaScript, and doubled quotes have distinct CSV and SQL roles. Select the context that produced the escaped text. If the source uses another dialect or is already literal text, an exact reversal may not be possible.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools