Q: How do I escape a string for use in a JSON value?

JSON string escaping rules: " → \", \ → \\, / → \/ (optional), backspace → \b, form feed → \f, newline → \n, carriage return → \r, tab → \t, Unicode codepoints below U+0020 → \uXXXX. In JavaScript: JSON.stringify(str) correctly escapes all special characters. In Python: json.dumps(str). Do not manually escape JSON strings — use a library to avoid edge cases with Unicode surrogate pairs and control characters.

Q: What are common text escaping mistakes?

Common mistakes: (1) Double-escaping — escaping already-escaped text, producing \\n instead of \n. (2) Context mismatch — using HTML escaping (&) in a JavaScript context, which does not prevent injection. (3) Forgetting to escape in template strings — using ${userInput} without sanitization. (4) Using the wrong quote escaping — SQL requires '' not \' in standard SQL. (5) Not escaping regex metacharacters (., *, +, ?, [, ]) when using user input as a regex pattern.

Question 1

What is text escaping and why is it needed?

Accepted Answer

Text escaping converts characters that have special meaning in a given context into safe representations. In JSON strings: \ → \, " → ", newline → 
, tab → 	. In JavaScript template literals: backtick → \`, ${...} → \${...}. In SQL: single quote ' → '' (or \' depending on dialect). Escaping is necessary to prevent data from being interpreted as code — improper escaping is the cause of SQL injection, XSS, and other injection vulnerabilities.

Question 2

What is the difference between escaping and encoding?

Accepted Answer

Escaping adds special prefix characters (backslashes, percent signs) to neutralize special characters: 
 for newline, %20 for space in URLs. Encoding transforms data into a completely different representation: Base64 converts binary to alphanumeric, HTML entities convert <  to <. Both make data safe to embed in a context, but the mechanism differs. Encoding is usually reversible with a corresponding decode step; escaping typically uses the same character set with added escape markers.

Question 3

How do I escape a string for use in a JSON value?

Accepted Answer

JSON string escaping rules: " → ", \ → \, / → / (optional), backspace → \b, form feed → \f, newline → 
, carriage return → , tab → 	, Unicode codepoints below U+0020 → \uXXXX. In JavaScript: JSON.stringify(str) correctly escapes all special characters. In Python: json.dumps(str). Do not manually escape JSON strings — use a library to avoid edge cases with Unicode surrogate pairs and control characters.

Question 4

What are common text escaping mistakes?

Accepted Answer

Common mistakes: (1) Double-escaping — escaping already-escaped text, producing \n instead of 
. (2) Context mismatch — using HTML escaping (&) in a JavaScript context, which does not prevent injection. (3) Forgetting to escape in template strings — using ${userInput} without sanitization. (4) Using the wrong quote escaping — SQL requires '' not \' in standard SQL. (5) Not escaping regex metacharacters (., *, +, ?, [, ]) when using user input as a regex pattern.

ilmaiset web-kehittäjän työkalut

Tekstin escapetus / unescapetus

Asetukset

Toiminnot

Syöte

Tuloste

Miten tekstin escape/unescape-työkalu toimii

Mitä työkalu tekee

Yleiset kehittäjien käyttötapaukset

Tietomuodot, tyypit tai variantit

Yleiset sudenkuopat ja reunatapaukset

Milloin käyttää tätä työkalua vs. koodia