Escape Characters_
Paste a string and get it as a source-code literal for fifteen languages at once. Quotes, newlines, tabs and backslashes handled the way each language actually wants them — not the way the one you use most wants them.
The differences are larger than they look. PowerShell escapes with a backtick and treats a backslash as an ordinary character. A bash single-quoted string cannot contain a single quote by any means at all. Standard SQL has no backslash escape and doubles the quote instead.
| Language | Literal |
|---|
- Input
- Any text, or an existing literal to read back.
- Output
- The literal for the language and quote style you picked, plus the same string in every other language for comparison.
- Processing
- Converted in this tab as you type. Nothing is uploaded.
- Limits
- It escapes a string for a literal. It does not sanitise input for a database or a shell — escaping is not a security boundary, and parameterised queries exist because of that.
- The one that catches people
- A hex escape names a character in Python, JavaScript and C# and a raw byte in Go, Rust, PHP, Ruby, bash and C. The syntax is identical either way.
Four differences that survive copy and paste
The escape character is not always a backslash
PowerShell uses a backtick. That single fact changes every string you write in it: C:\Users\me needs no treatment at all, because a backslash there is an ordinary character, while a newline is `n and a literal backtick is doubled. Copying a PowerShell string out of a tutorial written for any other shell is where this usually goes wrong — the backslashes survive, the meaning does not.
Some strings genuinely cannot hold some characters
A bash single-quoted string suppresses every form of interpretation, including the backslash. There is therefore no sequence at all that produces a single quote inside one — not difficult, impossible. The way out is to leave the string, write the quote outside it and come back: 'it'\''s'. A Go raw string has the same shape of problem with the backtick, and a Python raw string cannot end with a backslash. Where this page finds one of those characters in your input, it says so instead of pretending an escape exists.
Doubling the quote is the portable way
Standard SQL has no backslash escape. Writing \' to protect a quote is a habit picked up from MySQL, and on PostgreSQL, SQL Server, Oracle or SQLite the backslash is an ordinary character — so the quote it was supposed to neutralise closes the string early. That is the exact shape most injection bugs take. Doubling the quote works in every engine, including MySQL, including MySQL with NO_BACKSLASH_ESCAPES switched on. It is the only form with no host-dependent failure mode, so it is the one generated here for both SQL entries.
An unknown escape is usually not an error
Python does not reject "\d". It keeps both characters and raises a warning — one that 3.12 made visible by default and that is on a path to becoming a hard error. So a regular expression written in an ordinary string works today, warns loudly tomorrow and breaks eventually, which is the whole reason patterns belong in raw strings. Most other languages here take the same silent-until-it-is-not approach, and this page names the sequence when it reads one back.
Paste, pick the language, copy the literal
- 01Paste the raw string on the left — real newlines, real quotes, exactly as it should end up in memory.
- 02Pick the language and the quote style. The style matters: a raw or verbatim string escapes almost nothing, and a single-quoted string usually escapes less than a double-quoted one.
- 03Read the panel underneath if one appears. It names characters the style cannot hold at all, rather than emitting a literal that will not compile.
- 04Copy the result, or compare against the table of every language below when you are moving the same value between two of them.
When the language matters more than the string
A path into a script
A Windows path that must survive the language you paste it into.
C:\Users\me
unchanged — backslash is ordinary
An apostrophe into SQL
A name with a quote, going into a query.
O'Brien
'O''Brien' — doubled, not escaped
A multi-line value into YAML
A string with newlines, in a config file.
escapes are available
no escapes exist at all
Reading a literal back
You have the escaped form and want to know what it holds.
Unescape
sequences the language would reject
Which character starts an escape
| Language | Escape character | Quote inside a string | Newline |
|---|---|---|---|
PowerShell | Backtick ` | Backtick, or doubled in single quotes | `n |
SQL (standard) | None — the quote doubles itself | '' | No escape; concatenate CHAR(10) |
MySQL | Backslash, unless disabled by SQL mode | Both forms work; only doubling always does | \n |
Bash | Backslash, and only in double quotes | Impossible inside single quotes | A real newline, or \n in $'…' |
Python | Backslash | \', or use the other quote | \n |
Java | Backslash, expanded before parsing | \" | \n, or a real one in a text block |
YAML | Backslash in double quotes only | Doubled in single quotes | \n in double quotes only |
JSON | Backslash | \" — there is no escape for an apostrophe | \n |
Eight of the fifteen languages on this page treat the backslash as their escape character in every quote style. The rest either change it, disable it, or replace it with doubling.
Quote styles, and how much each one interprets
| Language | Style | Written as | Escapes |
|---|---|---|---|
JSON | string | "…" | 7 |
JavaScript | double-quoted | "…" | 9 |
JavaScript | single-quoted | '…' | 9 |
JavaScript | template literal | `…` | 9 |
Python | single-quoted '...' | '…' | 10 |
Python | double-quoted "..." | "…" | 10 |
Python | raw r'...' | r'…' | none |
Java | string literal | "…" | 9 |
Java | text block """ | """
…""" | 1 |
C# | regular | "…" | 11 |
C# | verbatim @"..." | @"…" | 1 |
C | string literal | "…" | 11 |
Go | interpreted | "…" | 9 |
Go | raw `...` | `…` | none |
Rust | string literal | "…" | 9 |
Rust | raw r#"..."# | r#"…"# | none |
PHP | double-quoted | "…" | 10 |
PHP | single-quoted | '…' | 2 |
Ruby | double-quoted | "…" | 12 |
Ruby | single-quoted | '…' | 2 |
PowerShell | double-quoted | "…" | 11 |
PowerShell | single-quoted | '…' | 1 |
Bash | double-quoted | "…" | 4 |
Bash | single-quoted | '…' | none |
Bash | ANSI-C $'...' | $'…' | 10 |
SQL (standard) | string literal | '…' | 1 |
MySQL | default mode | '…' | 8 |
MySQL | NO_BACKSLASH_ESCAPES | '…' | 1 |
YAML | double-quoted | "…" | 11 |
YAML | single-quoted | '…' | 1 |
A style with no escapes is not a limitation to work around — it is usually the right choice. Regular expressions and Windows paths belong in raw, verbatim or single-quoted forms precisely because nothing there is interpreted.
Habits that keep literals correct
- Pick the quote character your string does not contain. Half of all escaping disappears if a string full of apostrophes goes in double quotes.
- Put regular expressions in a raw string wherever the language has one — Python
r'', C#@"", Go and Java backticks, Rustr#""#. - Prefer doubling to backslashes in anything SQL-shaped. It is the only form that works across engines and across MySQL SQL modes.
- Never build a query by escaping a value into it. Escaping is a formatting step, not a security boundary; parameterised queries are the one that is.
- Watch the hex escapes when moving a literal between languages. The same sequence names a character in some and a raw byte in others, and nothing in the syntax marks the difference.
- Use the JSON escape, URL encode and HTML entity pages for wire formats — those are encodings, not source-code literals, and their rules are unrelated.
Where escaping goes wrong
The escape character is a backtick
PowerShell uses ` where every other language on this page uses \. A backslash is an ordinary character, which is why C:\Users\me needs no escaping and why "\n" is a backslash followed by an n rather than a newline. The newline is `n.
A single-quoted string cannot contain a single quote
Not "is hard to". Cannot. Single quotes suppress all interpretation including the backslash, so there is no sequence that produces a quote. The idiom is to close the string, escape a quote outside it, and reopen: 'it'\''s'.
Standard SQL doubles the quote and has no backslash
Writing \' to escape a quote is a MySQL habit. On PostgreSQL, SQL Server, Oracle and SQLite the backslash is an ordinary character, so the quote it was supposed to escape closes the string early — which is the shape most injection bugs take. Doubling works everywhere.
NO_BACKSLASH_ESCAPES changes which escapes exist
MySQL accepts both conventions by default. With that SQL mode enabled — and it is on some managed hosts — the backslash stops escaping and every \' in the codebase quietly stops working. A doubled quote works in both modes, so it is the one to emit.
\uXXXX is processed before the code is parsed
It happens in a pass over the source before lexing, not while reading a string. So a \u000A inside a // comment really does end the comment, and a \u0022 anywhere really does open a string. It is the only escape in this list that can break a file from inside a comment.
There is no hex escape
Every C-descended language on this page has \xHH except Java. Writing \x41 is a compile error, not the letter A. The four-digit \u0041 is what Java expects.
What is converted, and what is checked
- Languages
- JSON, JavaScript, Python, Java, C#, C, Go, Rust, PHP, Ruby, PowerShell, Bash, standard SQL, MySQL and YAML — thirty quote styles between them
- Direction
- Both. Escaping produces the literal; unescaping reads one back and reports sequences the language would reject or read differently from how they look
- Impossible characters
- A quote in a bash single-quoted string, a backtick in a Go raw string, a trailing backslash in a Python raw string. These are named rather than escaped, because no escape exists
- Byte and character escapes
- A hex escape is a code point in Python, JavaScript, C# and YAML, and a raw byte in Go, Rust, PHP, Ruby, Bash and C. The byte-oriented languages get one only below 0x80, and a code-point form above it
- Non-ASCII
- Passed through by default, because every language here reads UTF-8 source and a literal accented character is correct and readable. The ASCII-only switch escapes it numerically when the file encoding is not yours to control
- Astral characters
- Handled by code point, never split. Java and JSON get a surrogate pair because their escape is fixed at four digits; JavaScript, Rust, PHP and Ruby get a single braced escape
- Not a security boundary
- This produces a literal for source code. It is not input sanitisation: use parameterised queries for SQL and argument arrays rather than shell strings for commands
- Scope
- Source-code literals only. Percent-encoding lives in URL encode, entities in HTML encode, and code-point notations in Unicode escape
- Network
- None from tool code. A test sweep calls every function this page uses with
fetchandXMLHttpRequestreplaced by stubs that throw, so a stray request fails the build instead of shipping. Disconnect from the network and the page still works.
Questions about escape characters
What is an escape character?
A character that changes how the next one is read, so that something which would otherwise end the string or mean something structural can be included in it. A backslash is the usual choice, but it is a convention rather than a rule — PowerShell uses a backtick, and standard SQL has none at all and doubles the quote instead.
What is an escape sequence?
The escape character plus whatever follows it, taken together as one unit. Some name a character that is hard to type, like a tab or a newline. Some name one by number, like a hex or code-point escape. And some exist only to say this next character is data, not syntax, which is what escaping a quote does.
How do I escape a single quote in SQL?
Double it: O''Brien. That is the standard form and works in every engine. A backslash works in MySQL and only in MySQL, and stops working there too once NO_BACKSLASH_ESCAPES is set — which is why a codebase that relies on it can break on a host change rather than a code change.
What is the escape character in PowerShell?
The backtick, `. A backslash is an ordinary character, so Windows paths need no treatment and "\n" is a backslash followed by an n rather than a newline. The newline is `n, a literal backtick is doubled, and a single-quoted string interprets nothing except a doubled quote.
Why does Python warn about an invalid escape sequence?
Because the sequence is not one Python knows, so it keeps the backslash and the letter as two characters and tells you it had to guess. "\d" in a regular expression is the usual cause. It has been a warning since 3.6, is shown by default from 3.12, and is intended to become an error — putting the pattern in a raw string fixes it permanently.
Do I need to escape input before putting it in a query?
No — you need to stop putting it in the query. Escaping is a formatting step and every escaping scheme here has at least one mode where it does something different, which is precisely how injection bugs survive code review. Parameterised queries send the value separately from the statement, so no escaping is involved at any point.
Does the string I paste here go anywhere?
The work is JavaScript running in this tab. Every function it calls is covered by a test that stubs fetch and XMLHttpRequest to throw, so a request that slipped in would break the build rather than reach a server — and you can confirm it for yourself by disconnecting and carrying on.