String Escape

Escape a string for JSON, JavaScript or SQL — and reverse it. Free, runs entirely in your browser — no signup, and nothing you paste in is uploaded.

Each target has different rules and mixing them up is how injection bugs happen. JSON escapes with backslashes and requires control characters to become `\u` sequences; JavaScript adds its own quirks around quotes and line separators; SQL escapes quotes by doubling them, not by backslashing.

Which is the argument against doing this by hand in production code at all. Escaping for SQL is what parameterised queries exist to remove — if you are building a query by concatenating an escaped string, the escaping is doing security work that the database driver would do better. For a literal you are pasting into a config or a test fixture, though, this is exactly the job.