Plain Text
String Literal
Most languages use a backslash to start an escape, but the characters after it mean different things in each one. Pick the target language, paste the text, and get a string literal you can drop into source code, or paste a literal and read what it contains. The conversion runs in JavaScript in this page, so nothing is sent to a server.
It's "$5.00" for O'Brien
C:\Users\zoe\notes.txt
Tab: done ✓// JavaScript
"It\'s \"$5.00\" for O\'Brien\nC:\\Users\\zoe\\notes.txt\nTab:\tdone ✓"
// Python
"It\'s \"$5.00\" for O\'Brien\nC:\\Users\\zoe\\notes.txt\nTab:\tdone ✓"
// PHP
"It's \"\$5.00\" for O'Brien\nC:\\Users\\zoe\\notes.txt\nTab:\tdone ✓"
// Bash $'...'
$'It\'s "$5.00" for O\'Brien\nC:\\Users\\zoe\\notes.txt\nTab:\tdone ✓'
// SQL
'It''s "$5.00" for O''Brien
C:\Users\zoe\notes.txt
Tab: done ✓'JavaScript silently drops the backslash from \q and keeps the q. Python and PHP keep both characters (Python 3.12 also warns). Java refuses to compile. The unescape mode follows the selected language and lists any unknown sequences it met.
In JavaScript and Python, \xE9 is the character é. In PHP and Bash it is a single byte 0xE9, which is not valid UTF-8 on its own. For é in PHP you want \xC3\xA9 or \u{E9}. The tool decodes PHP and Bash escapes as bytes and tells you when they do not form valid UTF-8.
JavaScript and Java escapes are UTF-16, so 😀 becomes the pair \uD83D\uDE00. Python writes \U0001f600, PHP \u{1F600}, Bash \U0001F600. Unescape joins surrogate pairs back into one character.
Standard SQL escapes a quote by doubling it: 'O''Brien'. MySQL also treats backslash as an escape unless NO_BACKSLASH_ESCAPES is on; PostgreSQL only does inside E'...'. This mode is for reading and writing literals by hand. In application code, use bound parameters.
Bash single quotes is the mode to use for passing an
argument safely. Inside single quotes nothing is
special, so the only character that needs work is the single
quote itself, which becomes '\'': close the
quote, add an escaped quote, reopen. Line breaks, dollar
signs and backslashes all survive untouched. This is what
shlex.quote() and PHP's
escapeshellarg() do.
Bash $'...' is ANSI-C quoting, which reads
backslash escapes like C does. It is the readable choice
when the string holds tabs or other control characters.
\u and \U need Bash 4.2 or newer,
which rules out the Bash 3.2 that macOS still ships, so the
non-ASCII option is off by default. The unescape side
understands a full shell word, so
'it'"'"'s' and 'it'\''s' both come
back as it's.
Regex escapes the metacharacters
\ ^ $ . * + ? ( ) [ ] { } | / so the text matches as plain characters. It leaves the hyphen alone because escaping it
outside a character class is an error with the
u flag. Test the result in the
regex tester.
const text = `It's "$5"\n\tC:\\dir`;
// A double-quoted JavaScript literal: JSON.stringify output is valid JS
console.log(JSON.stringify(text)); // "It's \"$5\"\n\tC:\\dir"
// Escape user input before putting it in a RegExp
// (ES2025 adds RegExp.escape() for exactly this)
const escapeRegex = (s) => s.replace(/[\\^$.*+?()[\]{}|/]/g, "\\$&");
const re = new RegExp("^" + escapeRegex("price (USD) $5.00") + "$");
console.log(re.test("price (USD) $5.00")); // true
// Unescape without eval(): JSON.parse understands the escapes
// JSON shares with JavaScript (not \x41, \' or octal)
console.log(JSON.parse('"line\\nbreak \\u00e9"'));<?php
$text = "It's \"\$5\"\n\tC:\\dir";
// A PHP literal you can paste back into code
echo var_export($text, true), PHP_EOL;
// Shell argument: never build it by hand
echo 'grep ' . escapeshellarg("it's") . ' notes.txt', PHP_EOL; // grep 'it'\''s' notes.txt
// Regex: preg_quote, and pass your delimiter
echo preg_quote('price (USD) $5.00 / unit', '/'), PHP_EOL;
// Decode C-style escapes (\n, \t, \xHH, octal) in a string
echo stripcslashes('tab\there \x41\102'), PHP_EOL; // tab<TAB>here AB
// SQL: bound parameters, not escaping
// $stmt = $pdo->prepare('SELECT * FROM users WHERE name = ?');
// $stmt->execute(["O'Brien"]);Use escapeshellarg() for shell arguments and preg_quote() for regexes. addslashes() is not an SQL escape.
import re
import shlex
text = 'It\'s "$5"\n\tC:\\dir'
print(repr(text)) # a valid Python literal
print(shlex.quote("it's")) # 'it'"'"'s'
print(re.escape("price (USD) $5.00")) # price\ \(USD\)\ \$5\.00
# Decode backslash escapes. unicode_escape works on bytes and reads
# anything that is not an escape as Latin-1, so feed it ASCII only.
escaped = r"tab\there \u00e9 \x41"
print(escaped.encode("ascii").decode("unicode_escape")) # tab<TAB>here é Ashlex.quote() is for POSIX shells. It is not safe for cmd.exe or PowerShell.
Escaping follows the syntax of one specific literal. The same text needs different treatment as a JavaScript string, a shell argument, an SQL literal and a regex, and escaping for the wrong one is how injection bugs happen. Where a proper API exists (bound SQL parameters, argument arrays for subprocesses, textContent in the DOM), use it instead of escaping.
This tool follows the specifications below. Read them when you need the exact normative wording, for example to settle an edge case between two implementations.
Inside single quotes nothing can be escaped, so close the quote, add an escaped quote and reopen: 'it'\''s'. Pick Bash single quotes in the Language dropdown and the tool writes it for you.
Double it: 'O''Brien'. That is standard SQL and works in every major database. In application code, use bound parameters instead of escaping by hand.
In JavaScript and Python \xE9 is the character U+00E9. In PHP and Bash it is a single raw byte, which is not valid UTF-8 by itself. Use \xC3\xA9 or PHP's \u{E9} for é.
The metacharacters \ ^ $ . * + ? ( ) [ ] { } | and, inside a /.../ literal, the slash. The Regex option escapes exactly those, so the text matches as plain characters.
It depends on the language, and the tool follows the one you picked: JavaScript drops the backslash, Python, PHP and Bash keep it, and Java refuses to compile. Unknown sequences are listed under the tool.
For JSON specifically, the JSON escape tool follows RFC 8259 exactly. Text headed into markup belongs in the HTML encoder, text headed into a URL in the URL encoder, and to see the raw bytes behind a string try hex to text.