Loading the interactive tool… It runs in your browser — if it doesn't appear, enable JavaScript.
Paste raw text and get it escaped correctly for the target you're pasting into — a JSON document, a source-code string literal, a SQL query, a shell command, a CSV field, or a regular expression. Or go the other way and recover the original text from an escaped string.
Each target follows its own real rules rather than a generic backslash-everything approach. SQL doubles the quote, because that's standard SQL and portable, where backslash escaping is a MySQL extension. Shell wraps in single quotes and handles the quote itself by closing, escaping and reopening. JSON goes through `JSON.stringify`, so control characters and surrogate pairs are handled properly.
Frequently asked questions
Can I use this to make SQL safe from injection?
No. Use parameterised queries — escaping by hand is how SQL injection happens, because the rules vary by dialect, by character encoding, and by whether the value lands inside quotes at all. This tool is for building a literal you're writing yourself, such as a fixture or a one-off admin query, not for handling user input.
Why does SQL escaping double the quote instead of using a backslash?
Because doubling (`''`) is the ANSI SQL standard and works in PostgreSQL, SQLite, SQL Server and Oracle. Backslash escaping is a MySQL extension that can be switched off with NO_BACKSLASH_ESCAPES, so code relying on it breaks in ways that are hard to trace.
How does shell escaping work?
Everything inside single quotes is literal to a POSIX shell — no variable expansion, no globbing, no escape sequences. The single quote itself can't be escaped inside them, so the standard trick is to close the quote, emit an escaped quote, and reopen: `'\''`. That's what this produces.