String Escape/Unescape

The tool supports multiple escape formats including JSON (quotes, newlines, tabs), HTML entities, XML entities, URL encoding, and JavaScript string escaping, allowing you to prepare strings for different contexts.

Escape strings for JSON when you need to include special characters like quotes, backslashes, or newlines in JSON values, ensuring valid JSON syntax and preventing parsing errors.

Yes, the tool works bidirectionally. You can unescape encoded strings to see the original text, making it useful for debugging and understanding escaped data from APIs or databases.

HTML escaping converts characters like <, >, &, and quotes to HTML entities (<, >, &, ") to prevent XSS attacks and display issues, while JSON escaping handles characters that break JSON syntax.

URL encoding (percent-encoding) is a specific type of escaping that converts special characters to %XX format for safe use in URLs, which is different from JSON or HTML escaping.

Proper string escaping prevents injection attacks (XSS, SQL injection) by ensuring user input is treated as data rather than executable code, making it a critical security practice in web development.

JSON escaping follows a strict standard (RFC 8259) requiring backslash escapes for quotes (\"), backslashes (\), and control characters (\n, \t, \r). JavaScript string escaping is similar but more permissive, allowing additional escapes like \v (vertical tab), (null), and \x (hex escapes). JSON also requires UTF-16 surrogate pairs for characters outside the BMP, while JavaScript can use \u{XXXXXX} notation. Always use JSON escaping for API responses and data interchange to ensure strict compatibility.

Each language has specific escape requirements: Python uses backslashes (\n, \t, \') and supports raw strings (r'text'), JavaScript uses similar escapes plus template literals, C/C++ requires escaping quotes and backslashes, SQL requires doubling single quotes ('') or escaping them, and shell scripts need careful escaping of $, `, and quotes. Always use your language's built-in escape functions (like Python's json.dumps(), JavaScript's JSON.stringify(), or SQL's parameterized queries) rather than manual escaping to avoid vulnerabilities.

Essential escape sequences include: \n (newline/line feed), \r (carriage return), \t (tab), \" (double quote), \' (single quote), \ (backslash), (null character), \b (backspace), and \f (form feed). For Unicode: \uXXXX (4-digit hex) and \xXX (2-digit hex). Different contexts require different escaping - JSON uses \/, HTML uses < and >, XML is similar to HTML, and regular expressions use \d, \w, \s for character classes.

XSS attacks inject malicious scripts by exploiting unescaped user input in web pages. Proper escaping converts dangerous characters into safe representations: < becomes <, > becomes >, & becomes &, " becomes ", and ' becomes '. This prevents browsers from interpreting user input as HTML or JavaScript code. For example, if a user enters <script>alert('XSS')</script>, HTML escaping converts it to harmless text that displays literally instead of executing. Always escape output based on context - HTML for page content, JavaScript for script blocks, URL for links.