More
More
Escape, Encode & Decode
Escape and unescape text for JSON, JavaScript, HTML entities, XML, SQL, CSV, regex and URLs.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
All named entities this tool knows
| Character | Name | Number |
|---|
How to use it
- Choose the format: JSON, JavaScript, HTML, XML, SQL, CSV, regex or URL.
- Choose Escape or Unescape. For HTML, pick whether to encode only the five special characters or every non-ASCII one, as names or numbers; for URLs, pick a single component, a whole URL or form data where spaces become +.
- Paste your text. The result updates as you type.
- Copy the result, or press Swap to send it back to the input.
Questions
What does escaping a string mean?
Some characters have a special meaning in a format, such as a quote that ends a string or a less than sign that starts an HTML tag. Escaping writes them in a safe form so they are read as plain text.
Named or numeric HTML entities?
Both work in every browser. Names such as © are easier to read; numbers such as © work for every character, including the ones without a name, and in XML. On a page saved as UTF-8, accents and emoji need no entities at all.
Why is a space in a URL sometimes %20 and sometimes +?
In the path and in most of a URL a space is %20. HTML forms send their data with spaces as +, and most servers read + as a space in the query string. Decoding in Form style turns + back into spaces.
Which URL style should I use?
Use Component for anything that goes inside a URL, such as a search term or a redirect address in a query parameter. Use Whole URL only to tidy a full address that has spaces or accents but whose : and / must stay intact.
Does escaping SQL quotes or HTML stop injection attacks?
Escaping HTML before putting text in a page is the core defence against cross-site scripting, but the right escaping depends on where the text goes. For SQL, doubling single quotes helps with a one-off query by hand; in application code use parameterised queries.
When does a CSV field need quotes?
When it contains the delimiter, a double quote, a line break, or starts or ends with a space. The field is wrapped in double quotes and any double quote inside is written twice.
About this tool
What does escaping a string mean?
Some characters have a special job in a format: a quote ends a string, a less than sign starts an HTML tag, an ampersand starts a URL parameter. Escaping writes those characters in a safe form so they are read as plain text. Unescaping turns them back. This tool does both for eight formats.
Formats covered
- JSON and JavaScript strings. JavaScript escaping also covers single quotes and backticks.
- HTML entities and XML, using names such as © or numbers, for just the special characters or every non-ASCII one.
- URL encoding for a single component, a whole address, or form data where spaces become +.
- SQL string literals, CSV fields and regex patterns.
Tips
For URLs, use Component for anything placed inside an address, such as a search term or a redirect link in a parameter; encoding a whole link as a component also encodes its colons and slashes. Text is encoded as UTF-8, so é becomes %C3%A9. Doubling quotes in SQL is fine for a one-off query, but applications should use parameterised queries. Escaping text before it goes into HTML is the core defence against cross-site scripting.
Press Swap to send a result back to the input. Everything runs in your browser.
Related tools
- Base64 Encode & DecodeEncode and decode Base64 text.
- URL ParserSplit a URL into its parts and query parameters.
- JSON Formatter & ValidatorPretty-print, minify and validate JSON.
- Regex TesterTest regular expressions with live matches and a plain-English explanation.
- HTML Entities List & EncoderEvery named HTML entity with its codes, plus an encoder and decoder.