String Escape & Unescape Online
The Architecture of String Escaping & Injection Defense
In computing, the challenge of serializing human-readable text into structured protocols is known as the in-band signaling problem. When control delimiters (such as quotation marks, angle brackets, slashes, or ampersands) share the same transmission stream as raw user data, parsers can become confused between syntax instructions and literal content.
String escaping establishes unambiguous boundaries by substituting ambiguous literal characters with designated escape sequences (frequently prefixed with a backslash \ or an ampersand &).
1. Cross-Domain Escaping Specifications
| Standard / Format | Prefix / Delimiter | Critical Metacharacters | Primary Vulnerability Prevented |
|---|---|---|---|
| JSON (RFC 8259) | Backslash \ |
", \, \n, \r, \t, \b, \f |
JSON syntax breakage, invalid payload parse errors |
| HTML5 Entities | Ampersand &...; |
&, <, >, ", ' |
Cross-Site Scripting (XSS), DOM injection |
| URL Percent-Encoding (RFC 3986) | Percent %HEX |
Spaces, ?, #, &, =, / |
HTTP Request Parameter Tampering, URI parsing errors |
| Regular Expressions (PCRE / JS) | Backslash \ |
\, ^, $, ., *, +, ?, (, ), [, ], {, }, | |
ReDoS (Regular Expression Denial of Service), wildcard attacks |
| SQL Literals (ANSI / MySQL) | Quote doubling '' or \' |
', ", \0, \n, \r, \Z |
SQL Injection (SQLi) query escape breakout |
2. Deep Dive: JSON String Escaping (RFC 8259 §7)
The JSON specification strictly mandates that all code points from U+0000 through U+001F (control characters) MUST be escaped. Specifically:
- Quotations MUST become
\" - Reverse solidus MUST become
\\ - Control characters (such as null bytes, bell, escape) must use two-hex-byte unicode escapes:
\u0000through\u001F. - Forward slashes (
/) may optionally be escaped as\/to prevent</script>breakout when embedding JSON directly inside inline HTML script tags.
3. Escaping vs. Parameterization in Security
While escaping literal strings is critical for text representation and logging, it is essential to remember that string escaping is not a substitute for parameterized queries:
- SQL Injection: In modern database drivers, always utilize Prepared Statements with parameterized inputs (
?or$1). Escaping is only a fallback when building dynamic table names or identifiers. - XSS Prevention: Context matters. Escaping for an HTML element body (
<p>...</p>) requires HTML entity encoding. Escaping user data for inside an HTML attribute (<input value="...">) or inside an inline JavaScript script block requires JavaScript unicode escaping.
Frequently Asked Questions
- Why does JSON escaping convert forward slashes (/) to \/?
- In the JSON specification, escaping the solidus
\/is allowed specifically to allow JSON payloads to be safely embedded within HTML<script>tags without prematurely terminating the script block via</script>. - What is the difference between single quote doubling '' and backslash \' in SQL?
- Standard ANSI SQL uses quote doubling (
'O''Reilly') to escape string literals. MySQL and SQLite also support C-style backslashes ('O\'Reilly'), but quote doubling is universal and portable across PostgreSQL, Oracle, SQL Server, and SQLite. - Does this tool send my strings to any server?
- No. All string manipulation, regex replacements, and entity conversions execute exclusively inside your web browser’s local JavaScript engine.