DevTools Logo
All posts

String Escaping Rules: JSON, SQL, HTML Entities, and Regular Expressions

August 15, 2026 · DevTools

string-escape
json
sql
html
regex

String Escaping Rules: JSON, SQL, HTML Entities, and Regular Expressions

Unescaped characters in strings cause syntax crashes, JSON parse errors, and security vulnerabilities like SQL injection and XSS.

Escape and unescape strings across formats using the String Escape Utilities.

Escaping Rules by Format

  • JSON: Double quotes (\"), backslashes (\\), newlines (\n), tabs (\t), carriage returns (\r).
  • SQL: Single quotes escaped by doubling them (O''Reilly) or backslashes depending on SQL dialect.
  • HTML Entities: & $\to$ &amp;, < $\to$ &lt;, > $\to$ &gt;, " $\to$ &quot;, ' $\to$ &#39;.
  • Regular Expressions: Metacharacters ., *, +, ?, ^, $, {, }, (, ), |, [, ], \ require a leading backslash.

Try escaping code snippets instantly with the String Escape Utilities.

Tools mentioned in this post