字符串转义 / 还原
为 HTML、JSON、JavaScript、SQL 等格式转义和还原字符串
使用方法
粘贴或输入内容
在输入区域输入您的文字、代码或数据。
选择选项
选取要应用的转换方式或格式。
复制结果
一键将输出结果复制到剪贴板。
为什么使用此工具
100% 免费
没有隐藏费用，没有付费等级——所有功能完全免费。
无需安装
完全在浏览器中运行。无需下载或安装任何软件。
隐私且安全
您的数据永远不会离开您的设备。不会上传至任何服务器。
支持移动设备
完全响应式设计——在手机、平板或桌面电脑上均可使用。
String Escaping and Unescaping for Multiple Formats
Key Takeaways
- String escaping converts special characters into safe representations for their target format — JSON, XML, HTML, and more each have different rules.
- Improper escaping is a leading cause of injection vulnerabilities, parsing errors, and data corruption in web applications.
- All string processing happens entirely in your browser — your text data is never sent to any server.
Every programming language and data format has characters with special meaning that must be escaped when used as literal text. A backslash in JSON, angle brackets in XML, and quotes in CSV all require different escaping strategies. Understanding escape sequences across formats is essential for building robust applications that handle data safely.
Injection attacks from improper escaping account for over 30% of web application vulnerabilities according to OWASP.
Security Impact
Key Concepts
JSON Escape Sequences
JSON requires escaping backslashes, double quotes, and control characters (\n, \t, \r). Unicode characters can be represented as \uXXXX escape sequences.
XML and HTML Escaping
XML uses entity references (& < > " ') while HTML adds hundreds of named entities. CDATA sections offer an alternative to escaping in XML.
URL Percent-Encoding
URLs encode special characters as %XX hex pairs. This is distinct from other escaping methods and follows RFC 3986 rules for reserved and unreserved characters.
Backslash Escaping in Regex
Regular expressions use backslash to escape metacharacters. When regex is embedded in a JSON string, backslashes must be double-escaped.
Pro Tips
Always use your language's built-in serialization functions (JSON.stringify, encodeURIComponent) rather than manual escaping.
Be aware of double-escaping — when embedding escaped strings inside other escaped formats, each layer adds its own escaping.
Test with edge cases: empty strings, strings containing only special characters, null bytes, and Unicode surrogate pairs.
When debugging, unescape layer by layer — URL decode first, then JSON parse, then examine the raw string.
All string escaping and unescaping is performed entirely in your browser. Your text data, which may contain sensitive content, is never transmitted to any external server.