String Escape & Unescape

JSON (RFC 8259): quote and backslash get a backslash; newline, return, tab, backspace and form feed become \n \r \t \b \f; other control characters become \uXXXX. JavaScript: the same plus single quotes, backticks and ${for template literals. SQL: a single quote is doubled ('') — the standard's only escape inside a literal. HTML: & < > " and ' become character references, which is safe for both text nodes and double-quoted attributes. Shell: the POSIX single-quoted word, where a quote inside is written as '\'' (close, escaped quote, reopen). CSV (RFC 4180): a field containing a quote, comma or line break is wrapped in quotes with inner quotes doubled; otherwise it is left alone. Regex: the ECMAScript metacharacters get a backslash so the text matches itself.

The reverse applies each rule backwards and strips the context's surrounding quotes if present. JSON is parsed strictly, so an invalid escape such as \q is refused with the parser's reason. JavaScript accepts \n-style, \xHH, \uHHHH and \u{…} forms. HTML resolves numeric references and the five named ones this page writes plus &nbsp;; other named entities are left as typed.

Escaping makes a literal out of text you control; it does not make untrusted input safe. SQL should use parameterised queries, HTML should use a templating engine that escapes by context, and shells should receive arguments as arrays. Windows cmd.exe quoting, URL percent-encoding (see URL Encode & Decode) and Base64 are different operations. Nothing you enter leaves the browser; the same four anonymous usage counts as the rest of the site apply.