JS Escape / Unescape

About JavaScript String Escaping & Code Sanitization

In JavaScript and modern ECMAScript development, strings enclosed in single quotes ('), double quotes ("), or template backticks (\`) must escape delimiter characters, control codes, and non-printable bytes to avoid syntax errors, unexpected string termination, or cross-site scripting (XSS) vulnerabilities.

Standard JavaScript Escape Sequences

JavaScript provides built-in escape sequences prefixed by a backslash (\):

• \' — Single quote (escapes string literal termination in '...')
• \" — Double quote (escapes string literal termination in "...")
• \\ — Literal backslash character
• \n — Newline / Line Feed (U+000A)
• \r — Carriage Return (U+000D)
• \t — Horizontal Tab (U+0009)
• \uXXXX — 4-digit Unicode hex code point (e.g., \u00A9 for ©)
• \u{XXXXX} — Extended ECMAScript 6 Unicode code point for emojis (e.g., \u{1F600})

Why String Escaping is Essential

• Safe Data Injection in SSR / Templates: Embedding server-rendered JSON blobs or database outputs directly into client-side <script> tags without risking quote breaks or XSS attacks.
• Regex String Sanitization: Escaping metacharacters before passing user inputs into dynamic new RegExp() constructors.
• Cross-Platform Text Serialization: Ensuring newlines and carriage returns survive JSON serialization across Windows (\r\n) and Unix (\n) platforms.

Frequently Asked Questions (FAQ)