Skip to content
CornerTools

String Escape / Unescape

Escape or unescape text for JSON, JavaScript, HTML, XML, SQL, CSV, Java and C# strings.

Characters: 0
Mode

Turns text into the inside of a string literal for JSON, JavaScript, Java, C#, SQL or a CSV field, or into HTML and XML text; and reads escaped text back. Each format escapes only what its own parser needs, and reading back follows that language's rules, so a sequence one language accepts and another rejects is treated as that language treats it.

Unescaping names the first three invalid sequences with their line and column and counts the rest, and HTML decoding knows all 2,231 named character references of the HTML Standard. It runs in your browser: nothing you paste or open is sent anywhere.

Formats and options

  • JSON — escapes ", \ and the control characters U+0000 to U+001F, as RFC 8259 requires; / stays as it is. Unescaping accepts only JSON's own escapes.
  • JavaScript — escapes \, the chosen quote (", ' or a backtick, which also escapes $${), control characters, and U+2028 and U+2029, which older engines read as line breaks. Unescaping reads \x, \u{…}, legacy octal and line continuations.
  • Java — control characters without a short form are written in octal (\033). Java turns every \u escape into its character before it reads the source, so \u000A inside a string would end the line and break the program. Unescaping reads octal, \s and \uuuu0041.
  • C# — also escapes U+0085, U+2028 and U+2029, which C# counts as line breaks. Unescaping reads the variable-length \x, \U and \e.
  • HTML — escapes & < > " '; Characters can also name every non-ASCII character that has a name (&eacute;), or write each as a number (&#233;).
  • XML — escapes the same five characters, using &apos;. A character XML 1.0 cannot hold, such as U+0001, is an error.
  • SQL — doubles '. MySQL's dialect also escapes \, which MySQL reads as an escape by default; unescaping it reads \n, \0, \Z and keeps the backslash in \% and \_, as MySQL does.
  • CSV — quotes the field when it holds a comma, a quote, a line break or a space at either end, and doubles each ".
  • Unicode (\u) — writes every non-ASCII character as \uXXXX and \ as \\, leaving the rest readable.

Wrap in quotes adds the literal's quotes around the result. Non-ASCII as \u escapes keeps the result to ASCII for JSON, JavaScript, Java and C#; characters past U+FFFF, such as emoji, become a surrogate pair, or \u{1F600} in JavaScript when chosen. A carriage return is escaped in HTML and XML, as their parsers would otherwise read it as a line feed.

Unescaping removes quotes around the input when it is one whole literal, and says so. When the result still holds escapes, the text was probably escaped twice, and Unescape again runs another pass. Switching between Escape and Unescape carries the output into the input.

Examples

A JSON string with quotes and a line break

Input
He said "hi"
Bye
Format, Wrap in quotes
JSON, on
Output
"He said \"hi\"\nBye"

The quotes become \" and the line break \n, so the value fits on one line of a JSON document.

An emoji in a Java string

Input
Done 😀
Format, Non-ASCII as \u escapes
Java, on
Output
Done \uD83D\uDE00

Java strings are UTF-16, so a character past U+FFFF is written as its two surrogates.

An HTML snippet shown as text

Input
<a href="?a=1&b=2">Tom & Jerry</a>
Format
HTML, default options
Output
&lt;a href=&quot;?a=1&amp;b=2&quot;&gt;Tom &amp; Jerry&lt;/a&gt;

Placed in a page, the output shows the markup as text rather than as a link.

A JSON document stored as a JSON string

Input, Unescape, JSON
{\"note\":\"He said \\\"hi\\\"\\nBye\"}
Output
{"note":"He said \"hi\"\nBye"}

The output is the document, which still holds its own escapes, so the tool notes that the text may have been escaped twice and offers Unescape again. Here the second pass would break the document: unescape only as many times as the text was escaped.

How each format escapes

With Non-ASCII as \u escapes on, and HTML set to Named where one exists
CharacterJSONJavaScriptJavaC#HTMLXML
"\"\"\"\"&quot;&quot;
'''''&#39;&apos;
\\\\\\\\\\\
Line break (LF)\n\n\n\n
Tab\t\t\t\t
Escape (U+001B)\u001B\x1B\033\u001Bnot allowed
<<<<<&lt;&lt;
&&&&&&amp;&amp;
é\u00E9\u00E9\u00E9\u00E9&eacute;é
😀\uD83D\uDE00\uD83D\uDE00\uD83D\uDE00\uD83D\uDE00😀😀

Standards

HTML decoding follows the HTML Standard's rules for text: the longest matching name wins, the 106 legacy names such as &amp and &copy work without a semicolon, and numeric references from 128 to 159 are read as windows-1252, as browsers do (&#150; is an en dash). References to zero, to a surrogate or past U+10FFFF become U+FFFD, with a note. Inside an attribute value browsers leave a legacy name followed by a letter, digit or = as written; this tool decodes text.

Every escaped result is checked in the tool's tests by reading it back: JSON with a strict parser, JavaScript with the engine, HTML and XML with a browser parser.

Sources

Reviewed

Frequently asked questions

No. Escaping makes text safe inside a string literal or a document; URL encoding makes it safe inside a URL, writing bytes as %20 and so on. For a query parameter or a path, use the URL Encoder & Decoder.
JSON allows \/ but never requires it. Some encoders write it so that </script> cannot end a script block in a web page; the tool leaves it as is, and reads \/ back as /.
Escaping writes it as \uD800 in JSON, JavaScript, Java and C#, which can hold one; HTML and XML cannot, so it is an error. Unescaping one gives U+FFFD, the replacement character, with a note: the output is text, which cannot hold half a pair.

See also