String Escaper
Escape text for HTML, attributes, JavaScript, JSON, URLs, regular expressions or CSV.
About this tool
Escapes a string for a specific destination, and shows what changed.
The context selector is the point. **Escaping is not a property of the string** — the same text needs different treatment in HTML text, in an HTML attribute, inside a JavaScript literal and in a URL, and applying the wrong one produces something that looks escaped and is not. HTML-escaping a value being written into a JavaScript string, for instance, does nothing useful and leaves the injection open.
**There is no SQL option, on purpose.** Escaping is not how SQL injection is prevented; parameterised queries are. A tool offering to escape a value for SQL teaches exactly the habit that causes the problem, and there is no correct way to use its output.
Unescaping is available for every context that has an unambiguous inverse.
Common questions
Why does the context matter?
Because each destination has a different set of characters that end the current construct. A quote ends a JavaScript string; an angle bracket ends an HTML tag; an ampersand starts a new URL parameter. Escaping for the wrong one leaves the real one unescaped.
Why is there no SQL escaping?
Because it is the wrong answer. Parameterised queries send the value separately from the statement, so nothing in it can be read as syntax. Escaping for SQL is a technique with well-known bypasses and no reason to use it.
What is the difference between the HTML and attribute contexts?
Attribute escaping also handles quotes, because a quote ends the attribute value. Text escaping does not need to. Using text escaping on an attribute value is a common and exploitable mistake.
Should I escape when storing or when displaying?
When displaying, always. Escaping on the way into storage means you no longer have the original value, and you cannot know then which context it will be shown in later.