Escape and Unescape Strings: JavaScript, Java, C#, SQL, XML and CSV

What you can do here

• JavaScript escape and JavaScript unescape
• Java escape and Java unescape
• C# escape and C# unescape
• SQL escape (quote doubling) and SQL unescape
• XML escape (entities) and XML unescape
• CSV escape (RFC 4180 quoting) and CSV unescape

Click a language, choose Escape or Unescape, and paste your text; the output updates as you type. Swap moves the result back into the input and flips the operation, so you can check that a value round-trips. Each combination has its own link, for example /escape-unescape?mode=javascript-escape or ?mode=xml-unescape.

What string escaping does

Every language that lets you write a string in source code reserves a few characters — usually the quote that ends the string, and whatever character introduces an escape sequence. To put those characters inside a string you have to encode them in a way the parser for that language understands. Escaping rewrites a raw value into that encoded form; unescaping reverses it. The rules are not interchangeable: a backslash is meaningful in a C# string and meaningless in a standard SQL string, and CSV solves the same problem with doubled quotes and a wrapper rather than escapes at all.

The rules this tool applies

Target	On escape	Notes
C#	\→\\, "→\", and \0 \a \b \f \n \r \t \v; other control characters → \uXXXX	Regular (non-verbatim) string literal. Unescape also reads \xH..H and \UXXXXXXXX.
Java	\→\\, "→\", and \b \f \n \r \t; other control characters → \uXXXX	Unescape also reads octal escapes (\0–\377) and multi-u forms like \uu0041.
JavaScript	\ " ' ` and \b \f \n \r \t \v; U+2028/U+2029 → \u2028/\u2029; other control characters → \xXX	Unescape reads \xXX, \uXXXX, \u{...}, octal, and line-continuation backslashes.
SQL	'→''	ANSI / standard SQL. No backslash escaping. See the MySQL caveat below.
XML	&→&amp;, <→&lt;, >→&gt;, "→&quot;, '→&apos;	The five predefined entities. Unescape also resolves numeric references (&#169;, &#xA9;).
CSV	If the field contains , " or a line break: double every " and wrap the whole field in "…"	RFC 4180. A field without those characters is returned unchanged. The wrapping quotes are part of the output.

Escape sequences by language

* MySQL without NO_BACKSLASH_ESCAPES also treats backslash as an escape character; see the questions below.

Which target to pick

Choose the target that matches where the string will end up, not where it came from. A value pulled from a database that you are about to paste into a Java source file needs Java escaping. The same value going into an INSERT statement needs SQL. A value going into an XML attribute needs XML, and one going into a spreadsheet column needs CSV. C#, Java, and JavaScript look similar but differ in the details: JavaScript uses \xXX for low control characters where Java always uses \uXXXX, and only C# recognises \a and \v on unescape without complaint in every context.

Examples

SQL — quote doubling

raw:      O'Brien
escaped:  O''Brien
use:      INSERT INTO users(name) VALUES ('O''Brien');

C# / Java / JavaScript — backslash escapes

raw:      C:\temp	"log"
C#/Java:  C:\\temp\t\"log\"
JS:       C:\\temp\t\"log\"      (\t is a real tab in the raw input)

XML — entities

raw:      Tom & Jerry <3
escaped:  Tom &amp; Jerry &lt;3
use:      <title>Tom &amp; Jerry &lt;3</title>

CSV — RFC 4180 quoting

raw:      Redmond, WA
escaped:  "Redmond, WA"
raw:      She said "yes"
escaped:  "She said ""yes"""

Common questions