String Escaper
Escape text for JSON, HTML, URLs, SQL or regex.
About String Escaper
The String Escaper takes raw text and escapes it correctly for the context you choose: JSON strings, HTML, URLs, SQL literals or regular expressions. Escaping bugs are a classic source of both test failures and real vulnerabilities — a stray quote breaks a JSON fixture, an unescaped ampersand corrupts a URL, an unescaped dot makes a regex match too much.
Pick the target, paste the text, and copy the safely escaped result. It is also a handy way to learn what each context actually requires, since you can see exactly which characters were transformed.
How to use
- Choose the target context under "Escape for" — JSON, HTML, URL, SQL or regex.
- Paste your text into "Raw text".
- Copy the result from "Escaped" — it updates live as you type.
- "Load sample" demonstrates a string with quotes and special characters across contexts.
Frequently asked questions
When do I need JSON escaping?
Whenever you embed text inside a JSON string value by hand — in fixtures, request bodies or config files. Quotes, backslashes and newlines must be escaped or the document becomes invalid.
Does SQL escaping make input safe from injection?
Escaping quotes helps you build test literals, but for production code parameterized queries are the correct defense — string escaping alone is not a security control.
What does regex escaping do?
It backslash-escapes characters that have special meaning in patterns (like . * + ? ( )), so you can match a literal string — for example a URL or version number — inside a regular expression.