文字列エスケープ / アンエスケープ
HTML、JSON、JavaScript、SQLなどの文字列をエスケープ・アンエスケープ
使い方
テキストを貼り付けまたは入力
テキスト、コード、またはデータを入力エリアに入力します。
オプションを選択
適用する変換やフォーマットを選択します。
結果をコピー
ワンクリックで出力をクリップボードにコピーします。
このツールを使う理由
完全無料
隠れたコストもプレミアムプランもありません — すべての機能が無料です。
インストール不要
すべてブラウザで実行されます。ソフトウェアのダウンロードやインストールは不要です。
プライベート＆安全
データはデバイスの外に出ることはありません。サーバーにアップロードされることはありません。
モバイル対応
完全レスポンシブ対応 — スマートフォン、タブレット、デスクトップで利用できます。
String Escaping and Unescaping for Multiple Formats
Key Takeaways
- String escaping converts special characters into safe representations for their target format — JSON, XML, HTML, and more each have different rules.
- Improper escaping is a leading cause of injection vulnerabilities, parsing errors, and data corruption in web applications.
- All string processing happens entirely in your browser — your text data is never sent to any server.
Every programming language and data format has characters with special meaning that must be escaped when used as literal text. A backslash in JSON, angle brackets in XML, and quotes in CSV all require different escaping strategies. Understanding escape sequences across formats is essential for building robust applications that handle data safely.
Injection attacks from improper escaping account for over 30% of web application vulnerabilities according to OWASP.
Security Impact
Key Concepts
JSON Escape Sequences
JSON requires escaping backslashes, double quotes, and control characters (\n, \t, \r). Unicode characters can be represented as \uXXXX escape sequences.
XML and HTML Escaping
XML uses entity references (& < > " ') while HTML adds hundreds of named entities. CDATA sections offer an alternative to escaping in XML.
URL Percent-Encoding
URLs encode special characters as %XX hex pairs. This is distinct from other escaping methods and follows RFC 3986 rules for reserved and unreserved characters.
Backslash Escaping in Regex
Regular expressions use backslash to escape metacharacters. When regex is embedded in a JSON string, backslashes must be double-escaped.
Pro Tips
Always use your language's built-in serialization functions (JSON.stringify, encodeURIComponent) rather than manual escaping.
Be aware of double-escaping — when embedding escaped strings inside other escaped formats, each layer adds its own escaping.
Test with edge cases: empty strings, strings containing only special characters, null bytes, and Unicode surrogate pairs.
When debugging, unescape layer by layer — URL decode first, then JSON parse, then examine the raw string.
All string escaping and unescaping is performed entirely in your browser. Your text data, which may contain sensitive content, is never transmitted to any external server.