HTMLString Escape / Unescape
Escape or unescape strings for JavaScript, JSON, HTML entities, URL percent-encoding, SQL string literals, and CSV cells, then export a privacy-safe string escape QA pack with context risk notes, derived character inventory, and a starter Node assertion test. The pack intentionally omits raw pasted strings and converted output.
Ctrl+Enter to run | Ctrl+K to switch tools | Recent button shows input history
Repeating this work? Turn this kind of browser utility into an API batch, MCP prompt, extension workflow, or shared team recipe.
Buy Pro Browse tool packsFAQ
What is in the string escape QA pack?
It summarizes the selected mode and format, character counts, newline/tab/quote/backslash/entity-risk inventory, context notes, and a starter Node assertion test without copying the raw input or converted output.
What is the difference between JS and JSON escaping?
Both escape the same special characters, but JSON additionally requires Unicode-safe string literal behavior and does not allow single-quoted strings.
Is URL encoding the same as HTML encoding?
No — URL encoding converts characters to %XX hex sequences, while HTML encoding converts characters to named or numeric entities. Use URL encoding in query strings; HTML encoding in HTML attribute values and text content.
Does SQL escaping prevent injection?
Basic SQL string escaping (doubling single quotes) is a fallback — always use parameterized queries in production. This tool is for understanding the escape form and reviewing context boundaries, not as a security guarantee.