Turning unsafe characters into their literal-safe equivalents
The text 'Line 1 & bold "quoted"' HTML-escapes to 'Line 1 & <b>bold</b> "quoted"' -- each special character (&, <, >, ") replaced with its named HTML entity so the text displays literally instead of being interpreted as markup.
Without this escaping, a string containing '' pasted directly into HTML would be interpreted as an actual bold tag rather than displayed as the literal text '' -- escaping is what lets user-provided or dynamic text be safely rendered as visible text inside HTML without being executed as markup.
This same escape-before-insert principle is one of the core defenses against HTML/script injection: text that will be inserted into an HTML page should always be escaped first, precisely to prevent characters like < and > from being interpreted as actual tags.
Why different modes use genuinely different rules
JS uses JSON.stringify slice. HTML uses a small entity map. Python and SQL are not separate engines. HTML escaping and JavaScript string escaping solve different problems and use different character sets -- HTML cares about markup-significant characters (&, <, >, ", '), while JavaScript string escaping cares about characters that would break a string literal (quotes, backslashes, newlines), which is why this tool's JS mode uses JSON.stringify's own escaping logic rather than the HTML entity map.
Despite what the mode selector might suggest, Python and SQL string escaping are not implemented as fully separate rule sets here -- if you need SQL-specific escaping (which has its own quoting and injection-prevention conventions, and should generally be handled by parameterized queries rather than manual escaping) or Python-specific string literal escaping, verify this tool's output actually matches the target language's real rules rather than assuming full native support.
Escaping and encoding are related but not identical concepts -- URL encoding (percent-encoding), Base64 encoding, and HTML entity escaping all transform text for different contexts and aren't interchangeable, so make sure the mode you pick actually matches the destination context for the text.
Related encoding and format tools
For percent-encoding text specifically for use in a URL (a different transformation than HTML escaping), the URL Encoder/Decoder handles that.
For HTML and XML entity conversion specifically as its own dedicated tool, the HTML/XML Entity Encoder & Decoder covers a broader entity set than this general-purpose escaper.
Frequently Asked Questions (FAQ)
Why does escaping matter for text that will be inserted into HTML?
Without escaping, characters like < and > in the text would be interpreted as actual HTML markup rather than displayed as literal characters -- escaping (converting them to < and >) is a core defense that keeps user-provided or dynamic text safely rendered as visible text rather than executed as code.
Is JavaScript string escaping the same as HTML escaping?
No. JS uses JSON.stringify slice. HTML uses a small entity map. Python and SQL are not separate engines. They solve different problems: HTML escaping handles markup-significant characters, while JavaScript string escaping handles characters that would break a string literal, like quotes and backslashes -- genuinely different rule sets for different contexts.
Does the SQL mode produce injection-safe SQL escaping?
Treat it cautiously. Python and SQL are not separate engines. This tool doesn't implement a fully independent SQL escaping engine -- the safest practice for SQL is always parameterized queries/prepared statements rather than manual string escaping, regardless of what any escaping tool outputs.
Is URL encoding the same thing as HTML escaping?
No, they're different transformations for different contexts. URL encoding (percent-encoding) makes text safe to include in a URL; HTML escaping makes text safe to display inside HTML markup. Use the mode that actually matches where the text is headed.
What happens if I unescape already-plain text?
Unescaping text with no actual escape sequences typically returns it unchanged, since there's nothing to convert back -- it's a safe, idempotent operation to run on text you're not certain has been escaped.
