Text Escaper
Escape and unescape special characters
| Carácter | Escapado | Descripción |
|---|---|---|
| < | < | Menor que |
| > | > | Mayor que |
| & | & | Ampersand |
| " | " | Comillas dobles |
| ' | ' | Comilla simple |
Escapador de Texto
Escapa o desescapa caracteres especiales para diferentes contextos: HTML, URLs, JSON, JavaScript, XML, CSV, expresiones regulares y SQL. Esencial para prevenir errores de sintaxis y vulnerabilidades de seguridad.
Online Text Escaper - Escape HTML, URL, JSON and SQL
Why do you need to escape text?
Escaping matters for two reasons: preventing syntax errors, such as quotes inside strings or a < inside HTML, and preventing injection attacks. Unescaped text can break HTML when it contains a script tag, break JSON when it carries unescaped quotes, cause SQL injection when it is concatenated into a query, and break URLs when it holds special characters. Every context has its own set of characters needing special treatment, and this tool applies the right escaping for each format.
Types of escaping and when to use each
HTML escaping converts < > & and " into entities, which is essential for showing user text on a web page without XSS risk. URL encoding converts spaces and special characters into %XX, which URL parameters require. JSON escaping escapes quotes and control characters to produce valid JSON strings. JavaScript escaping is similar to JSON but also covers backticks for template literals. SQL escaping doubles single quotes to prevent injection, although prepared statements are always the better answer. Regex escaping escapes metacharacters such as . * + and ? so they match literally.
Security: escaping versus sanitisation versus validation
Escaping preserves the text by turning dangerous characters into safe representations. Sanitisation strips dangerous content outright. Validation rejects invalid input before it goes anywhere. For solid security: validate the input format, sanitise where necessary, and escape at output according to the destination context. Escaping should never be your only defence against injection: use prepared statements for SQL, a Content Security Policy against XSS, and templating libraries that escape automatically. This tool helps you understand and apply the correct escaping.
If you work with this tool, you will probably also find these useful HTML Encoder, URL Encoder, JSON Formatter, Word Counter.
Frequently asked questions
Is HTML escaping enough to prevent XSS?
Escaping < > & and " prevents XSS in HTML content but not in every context. Unquoted attributes, event handlers such as onclick, javascript: URLs and CSS all need additional or different escaping. For complete protection, use a templating library that escapes automatically together with a Content Security Policy.
Why is my SQL-escaped text still vulnerable?
Manual SQL escaping is error prone and varies between databases, since MySQL, PostgreSQL and SQL Server differ in the details. ALWAYS use prepared statements or parameterised queries, which separate code from data. Manual escaping is acceptable only as a last resort when prepared statements are genuinely impossible.
How do I unescape text that was escaped several times?
Apply the unescaping as many times as it was escaped. "&lt;" needs two passes: the first gives you "<" and the second gives you "<". Double escaping usually happens when a system escapes text that was already escaped, so inspect the text to work out how many layers it carries.
Are URL encoding and HTML encoding the same thing?
No. URL encoding uses %XX, so a space becomes %20. HTML uses entities, and ordinary spaces need no escaping in HTML at all. An ampersand in a URL is %26, while in HTML it is &. Using the wrong escaping for the context produces malformed text or, worse, a security hole.