JavaScript String Escape & Formatter
Create JavaScript string literals with single quotes, double quotes, or template literals.
- Sin límites de longitud
- Sin registro
- Gratis para siempre
- Tu texto nunca sale de tu navegador
Single Quotes vs. Double Quotes vs. Backticks
JavaScript offers three ways to write a string literal, and each one changes what you have to escape. Single quotes and double quotes produce identical strings — the only difference is which character terminates the literal — so the practical rule is to use the quote that appears least in the content. Backticks create template literals, which support multi-line text and embedded expressions, and which bring their own escaping rules.
This page generates a safely escaped literal in whichever style you choose. Paste plain text, pick single quotes, double quotes, or backticks, and copy the result straight into code. The escaping accounts for the quote character itself, backslashes, and line breaks, and — for template literals — for the interpolation opener when it must appear literally rather than execute.
Preventing XSS
Escaping a string literal prevents syntax errors; it does not prevent injection. The common mistake is assuming that quote-escaped text is therefore safe to drop into the page. When you build HTML by concatenation and insert it with innerHTML, the browser parses the value as markup — a user-supplied string containing a script tag or an event-handler attribute executes regardless of how carefully the JavaScript string was escaped.
The correct defense is context-aware output encoding. Text inserted into an HTML text node must have its angle brackets and ampersands encoded; text placed inside an attribute needs its quotes encoded for that attribute context; and text going into a URL or a script context needs its own treatment. Prefer textContent over innerHTML, let your template engine auto-escape, sanitize with a maintained library when the input is rich, and add a Content-Security-Policy so a slip cannot escalate.
Preguntas frecuentes
How do I escape a backtick in a template literal?
Inside a template literal, prefix the backtick with a backslash so it is treated as text instead of closing the literal, and do the same for the interpolation opener if you need it verbatim. When the text comes from a user or another system, avoid building JavaScript source altogether: insert the value through textContent or a template engine that escapes for you. Hand-escaped code is where injection bugs start, so treat literal generation as a convenience for trusted strings rather than as a security control.
Tu texto nunca sale de tu navegador
Cada herramienta se ejecuta localmente en tu dispositivo. Nada de lo que pegues se sube, se almacena ni se rastrea.