String Escaper for Code
Escape or unescape text for a JSON string, a JavaScript template literal, PHP single or double quotes, a POSIX shell, a SQL literal, a regex or a CSV field.
Free · No sign-up · Your inputs stay in your browser
Input
Escape a string for code
Output
Result
56 characters
A quoted literal is for code you write by hand. For SQL, pass values as bound parameters instead: escaping by hand is how injection happens. For a shell, single quotes are the only form in which nothing is interpreted.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The shell's single quote
Inside single quotes a POSIX shell interprets nothing, not even a backslash, so the only character that needs care is the single quote itself. The standard trick ends the string, adds an escaped quote and reopens it: 'it'\''s'. That is what PHP's escapeshellarg() produces.
Do not build SQL by escaping
Doubling quotes produces a valid SQL literal for a script you write by hand, but application code should never build queries by concatenation, escaped or not. Bound parameters keep data out of the SQL entirely; the OWASP SQL injection cheat sheet ranks them first for that reason.