payload.txt — 3 tools ● LIVE
Input · RAW TEXT EDITABLE
NETWORK PAYLOAD: 0 BYTES · PROCESSING: LOCAL
Output · ESCAPED 0 SEQUENCES 

            

            

              
              
              EVERY SEQUENCE HIGHLIGHTED
            

          


          
        


        
        

          
Characters in0RAW TEXT

          
Characters out0ESCAPED

          
Escapes made0SEQUENCES ADDED

          
Size change+0GROWTH

        

      


      
      

        

          
 Developer Tools · Group 16 of 19

          
Escape &
Unescape.

          
Three contexts, three dialects, one bench. Make quotes, angle brackets, ampersands and backslashes safe for wherever they're headed — a string literal, a SQL statement, an XML document — and flip the direction to read them back. Every escape sequence lights up the moment it's made, so you can see exactly what changed and what sailed through. Round-trip with one click and land exactly where you started. Nothing is uploaded, nothing is stored.

        

        
    
          
  • Tools03
    • 
          
  • Directions02
    • 
          
  • Contextstext·SQL·XML
    • 
          
  • Backendnone
    • 
          
  • Costfree
    • 
        

      

    

  


  
  

  
  

    

      

        
In order, 01 → 03
Three dialects of "safe to embed."

        ( 01 )
      


      
      

        
        

          
The string-literal dialect — the one JSON, JavaScript and most config formats speak. Quotes become \", backslashes become \\, newlines and tabs become \n and \t, and anything non-ASCII turns into a \uXXXX escape so it survives any ASCII-only pipe. Flip to unescape and the sequences fold back into the characters they stand for, surrogate pairs rejoining into emoji on the way. Every sequence is highlighted as it's made or resolved.

          

            Example · escape
            
He said "hi"
and	left.

            
            
He said \"hi\"\nand\tleft.

          

          
Use it for JSON stringsJS literalsconfig valuesembedding text in code

        

      


      
      

        
        

          
The database dialect, where the single quote is the one character that matters. Escaping doubles every ' — the SQL standard — so O'Brien becomes O''Brien and can sit safely inside a quoted literal without terminating it early. Each doubled quote lights up so you can audit exactly what changed. One honest caveat, stated plainly: manual escaping is not a substitute for parameterized queries — prepared statements are the real defense against injection. This tool is for understanding, building and reading literals.

          

            Example · escape
            
WHERE name = 'O'Brien'

            
            
WHERE name = '''Brien' — the quote is doubled, the string stays whole.

          

          
Use it for building literalsreading escaped SQLlearning escapingdata imports

        

      


      
      

        
        

          
The markup dialect, where five characters carry all the syntactic danger. Escaping turns & < > " ' into &amp; &lt; &gt; &quot; &apos; so they read as data instead of tags and attributes — essential whenever markup or user text goes inside an XML or HTML document. Unescape reverses it, decoding the named entities plus numeric (&#8212;) and hex (&#x2014;) forms, with anything unrecognized left untouched and counted.

          

            Example · escape
            
<b>Tom & Jerry</b>

            
            
&lt;b&gt;Tom &amp; Jerry&lt;/b&gt;

          

          
Use it for embedding markupXML configSOAP & feedsHTML-safe output

        

      


      
Escaping rules · text escaping is backslash-based for string literals: \" \\ \n \t \r \b \f and \uXXXX for non-ASCII · SQL escaping doubles single quotes per the SQL standard and is for understanding and building literals — use parameterized queries for real injection defense · XML escaping covers the five special characters and decodes named, numeric and hex entities · every tool is lossless and bidirectional — escape then unescape returns the original exactly · every sequence is highlighted as it's made or resolved · the Feed back button sends the output back as input with the direction flipped, for a one-click round-trip · nothing you type leaves the tab

    

  


  
  

    

      The privacy promise
      
Embed anything. We couldn't read it even if we wanted to.

      
This page has no backend and no database. Every quote doubled, every entity written and every sequence highlighted just now happened inside your own browser tab — your text never traveled a single centimeter of cable. Close the page and it's gone for good.


      
      
✕ SERVER · DATABASE · LOGS · ANALYTICS


      
    
        
  • Databasenull
    • 
        
  • Backendnone
    • 
        
  • Text uploads0
    • 
        
  • Session logs0
    • 
      

    

  


  
  

    

      

        
Questions
Asked often, answered plainly.

        ( 02 )
      


      

        What does escaping actually do?
        
Escaping converts characters that have special meaning in a given context into a safe representation, so they're treated as literal data instead of syntax. A quote inside a quoted string, an angle bracket inside markup, an ampersand inside XML — each would otherwise be misread as structure. Escaping makes them inert, and unescaping turns them back into what they were.

      

      

        Why isn't SQL escaping enough to prevent SQL injection?
        
It isn't, and it's important to say so plainly. Manually escaping quotes is fragile: character-set tricks, second-order injection and database-specific escape rules can all defeat it. The real defense is parameterized queries (prepared statements), where the driver separates code from data for you. This tool is for understanding escaping, building literals and reading escaped SQL — not a security boundary.

      

      

        What's the difference between text escaping and XML escaping?
        
They serve different contexts with different syntaxes. Text escaping is backslash-based, for string literals in code and data formats: a newline becomes \n, a quote becomes \", a backslash becomes \\. XML escaping is entity-based, for markup: < becomes &lt;, & becomes &amp;. Escaping a string for JSON and pasting it into XML would be wrong — pick the tool that matches where the text will actually be parsed.

      

      

        Can I round-trip — escape and then unescape?
        
Yes, every tool here is lossless and bidirectional. Escape something, hit the Feed back button, and the output becomes the input with the direction flipped — unescape it and you're back to exactly what you started with, character for character. It's the fastest way to verify that a round-trip is clean.

      

      

        Is my data saved anywhere?
        
No. Stack has no backend and no database. Escaping happens inside your browser tab and the text vanishes the moment you close or refresh the page. Nothing is logged, because nothing is ever collected.