Utiltown

String Escape / Unescape – JS, HTML, SQL

Escape or unescape a string for three common targets from a single box: JavaScript string literals, HTML entities, and SQL string values. Escape makes raw text safe to embed inside code, and unescape restores an escaped value back to its original characters. Everything runs locally in your browser and nothing is uploaded.

All computations run locally in your browser, no data uploaded to server. 
  
  
 
How To Use
 
     
  1. Pick the target language (JavaScript, HTML, or SQL).
    2.  
  2. Type or paste your text into the source text box.
    3.  
  3. Click Escape to turn the raw text into a safe literal, or Unescape to decode a literal back into plain text.
    4.  
  4. Click Copy to put the result on your clipboard, or Demo to load a sample with quotes, an ampersand, and an apostrophe.
    5.  
 
 
 
Usage Example
 

Take the sentence below and run it through each mode to see how the
        same characters are handled differently by each language.

 
It's O'Reilly's <b>book</b> "best seller"
 
 JavaScript escapes the double and single quotes and the
        backslash, turning apostrophes into \' and double quotes
        into \". HTML turns <,
>, &, and quotes into entities such as
&lt; and &amp;. SQL
doubles every single quote, so O'Reilly becomes
O''Reilly. Click Unescape in the matching
        mode to reverse each result back to the original text.

 
 
 
Frequently Asked Questions
  
What is the difference between JavaScript, HTML, and SQL escaping?
 
Each language has its own rules for the characters that must be escaped and how the escape sequences look. JavaScript uses backslash sequences such as \n and \" inside string literals. HTML uses named or numeric entities such as &amp; for & and &lt; for <. SQL (ANSI/ISO) doubles a single quote, so ' becomes ''. Choosing the wrong mode produces output that will not work when pasted into the target language.
  
Why should I escape a string at all?
 
Escaping serves two purposes. First, it prevents injection attacks: an unescaped quote in an SQL query (SQL injection) or unescaped < in HTML (cross-site scripting) can let untrusted input change the meaning of surrounding code. Second, correct escaping lets you embed one value inside another without breaking it, for example storing text that contains a quote inside a string literal. Most programming frameworks and templating engines escape automatically; you should still understand and verify how a value is embedded.
  
What does '' mean in SQL?
 
In standard SQL a string value is wrapped in single quotes, for example 'O''Reilly'. Because the quote character signals the start and end of the value, a quote that is part of the data must be written twice: ''. Doubling is the standard (ANSI/ISO) way to include a literal apostrophe in a string, and unescaping reverses '' back to a single '.
  
Is this tool local?
 
Yes. Every escape and unescape operation is computed in your own browser. No text is sent to a server, nothing is uploaded, and the page works even when you are offline after it has loaded.
  
Can I unescape text written for a different quoting style?
 
The tool follows one documented convention per mode. For SQL it uses standard single-quote doubling and leaves backslashes untouched, so it matches ANSI/ISO databases. For JavaScript and HTML it follows the standard literal or entity rules. If a value came from a database that instead uses backslash escaping, you may need to check its convention before relying on the result.