Q: How do I escape a string for use in a JSON value?

JSON string escaping rules: " → \", \ → \\, / → \/ (optional), backspace → \b, form feed → \f, newline → \n, carriage return → \r, tab → \t, Unicode codepoints below U+0020 → \uXXXX. In JavaScript: JSON.stringify(str) correctly escapes all special characters. In Python: json.dumps(str). Do not manually escape JSON strings — use a library to avoid edge cases with Unicode surrogate pairs and control characters.

Q: What are common text escaping mistakes?

Common mistakes: (1) Double-escaping — escaping already-escaped text, producing \\n instead of \n. (2) Context mismatch — using HTML escaping (&) in a JavaScript context, which does not prevent injection. (3) Forgetting to escape in template strings — using ${userInput} without sanitization. (4) Using the wrong quote escaping — SQL requires '' not \' in standard SQL. (5) Not escaping regex metacharacters (., *, +, ?, [, ]) when using user input as a regex pattern.

Question 1

What is text escaping and why is it needed?

Accepted Answer

Text escaping converts characters that have special meaning in a given context into safe representations. In JSON strings: \ → \, " → ", newline → 
, tab → 	. In JavaScript template literals: backtick → \`, ${...} → \${...}. In SQL: single quote ' → '' (or \' depending on dialect). Escaping is necessary to prevent data from being interpreted as code — improper escaping is the cause of SQL injection, XSS, and other injection vulnerabilities.

Question 2

What is the difference between escaping and encoding?

Accepted Answer

Escaping adds special prefix characters (backslashes, percent signs) to neutralize special characters: 
 for newline, %20 for space in URLs. Encoding transforms data into a completely different representation: Base64 converts binary to alphanumeric, HTML entities convert <  to <. Both make data safe to embed in a context, but the mechanism differs. Encoding is usually reversible with a corresponding decode step; escaping typically uses the same character set with added escape markers.

Question 3

How do I escape a string for use in a JSON value?

Accepted Answer

JSON string escaping rules: " → ", \ → \, / → / (optional), backspace → \b, form feed → \f, newline → 
, carriage return → , tab → 	, Unicode codepoints below U+0020 → \uXXXX. In JavaScript: JSON.stringify(str) correctly escapes all special characters. In Python: json.dumps(str). Do not manually escape JSON strings — use a library to avoid edge cases with Unicode surrogate pairs and control characters.

Question 4

What are common text escaping mistakes?

Accepted Answer

Common mistakes: (1) Double-escaping — escaping already-escaped text, producing \n instead of 
. (2) Context mismatch — using HTML escaping (&) in a JavaScript context, which does not prevent injection. (3) Forgetting to escape in template strings — using ${userInput} without sanitization. (4) Using the wrong quote escaping — SQL requires '' not \' in standard SQL. (5) Not escaping regex metacharacters (., *, +, ?, [, ]) when using user input as a regex pattern.

các công cụ miễn phí dành cho lập trình viên web

Thoát / Bỏ thoát ký tự văn bản

Cấu hình

Hành động

Đầu vào

Đầu ra

Cách Công Cụ Escape/Unescape Văn Bản Hoạt Động

Công cụ làm gì

Các trường hợp sử dụng phổ biến cho lập trình viên

Định dạng dữ liệu, kiểu hoặc biến thể

Các lỗi thường gặp và trường hợp biên

Khi nào nên dùng công cụ này thay vì viết mã