Minimal escaping, not hex
This escapes only the characters that actually need it to safely embed text in a string literal — quotes, backslashes, and control characters like newlines and tabs — leaving everything else, including accented letters and emoji, untouched and readable. For encoding every character (to \xHH, \uHHHH, &#xHH;, or a SQL hex literal), see Hex Encode instead.
- JSON — escapes
",\, and control characters exactly per the JSON spec (viaJSON.stringify). Non-ASCII text is left as-is; JSON strings are Unicode text, not ASCII-only. - JavaScript — the same, plus
'and`, so the result is safe to drop into a single-quoted, double-quoted, or template string literal without knowing in advance which one you'll use. - SQL — doubles single quotes (
'→''), the ANSI-standard way to include a literal quote inside a SQL string literal, portable across Postgres, SQL Server, and standard-compliant MySQL.
FAQ
Why does JavaScript mode escape backticks even for single-quoted strings?
So the same output works no matter which of the three JS string forms it ends up in — one escape produces a value that's safe everywhere, rather than needing to pick a quote style up front.
Does SQL mode handle backslash escaping too?
No — only single-quote doubling, the portable ANSI SQL approach. MySQL's non-standard backslash escaping (outside ANSI_QUOTES mode) isn't handled here, since doubling works correctly there too and stays portable to every other engine.
Try it yourself
For full per-character hex or Unicode escape sequences instead of minimal escaping, see Hex Encode. For HTML/XML entity escaping specifically, see HTML Encode.