String escape / unescape

JSON is a strict subset of JavaScript object literal syntax:

• JSON strings only support double quotes; JS accepts single, double or backticks.
• JSON only knows about \", \\, \/, \b, \f, \n, \r, \t, \uXXXX. JS additionally knows \x, \u{…}, \', \0.
• JSON has no comments. JS does (this is irrelevant for a single string, but worth keeping in mind).

Picking JSON gives you output that's safe in either context. Picking JS gives you the more idiomatic form for a hand-written source file.

Strict CSV escaping has just three rules:

• If a value contains ,, ", CR or LF, wrap it in "…".
• Inside a quoted value, double up any literal " — i.e. he said "hi" becomes "he said ""hi""".
• Otherwise, output the value unchanged.

This tool implements exactly that. The output is safe to drop into a CSV column without breaking the spreadsheet that opens it.

The POSIX-safe approach is single-quote escaping: wrap the value in '…', and replace any embedded single quote with the four-char sequence '\'' (close the literal, escape a single ', re-open the literal). This survives every shell — bash, zsh, sh, dash, ksh — without surprises. We use this scheme; the output is ready to paste as a single argument.

Regex mode escapes every JS-regex metacharacter (\ ^ $ . * + ? ( ) [ ] { } | /) so the input matches itself literally when dropped into new RegExp(…). Useful when a user-supplied substring needs to feed a search regex without their punctuation being interpreted.

HTML mode escapes the minimal five-char set (& < > " ') — the same logic as the dedicated HTML-entities tool, surfaced here for convenience when you're escaping a single value rather than a body of text.