Question 1

When do I need to escape a string for JSON?

Accepted Answer

Any time you embed a string value in JSON that contains double quotes, backslashes, or control characters (newline 
, tab 	, carriage return ). Forgetting to escape these causes invalid JSON. JSON.stringify(value) in JavaScript handles this automatically.

Question 2

What characters need escaping in SQL?

Accepted Answer

Single quotes in SQL string literals must be escaped by doubling them ('O''Brien') or using the escape character. Backslashes need escaping in MySQL (\). Parameterised queries (prepared statements) handle escaping automatically and are the correct approach — manual string escaping is error-prone and risks SQL injection.

Question 3

Why does escaping for regex differ from JSON?

Accepted Answer

Regex metacharacters (. * + ? ^ $ | ( ) [ ] { } \) must be escaped with a backslash when you want a literal match. This is independent of the string escaping of the surrounding language — in JavaScript you may need double-escaping: var re = /\d+/ vs new RegExp('\d+').

Question 4

Is my data safe here?

Accepted Answer

Yes. Processing runs in your browser. Nothing is sent to a server.

String Escape

String escaping

String Escape

Related tools

String escaping