Escaping is about context
A string is never “escaped” in the abstract; it is escaped for one specific place it is about to be inserted into, and each place has its own rules. The same text needs \" in JSON, '' in SQL, '\'' in a shell and " in HTML. Using the wrong one is how injection bugs happen: HTML-escaping before putting text in a JavaScript string, or shell-escaping with double quotes and leaving $ live.
| Context | What must be escaped | How |
|---|---|---|
| JSON string | " \ and control chars | \" \\ \n \t \u00XX |
| Shell, single quotes | ' | '\'' (close, literal quote, reopen) |
| Shell, double quotes | " \ $ ` and ! in interactive bash | backslash |
| SQL literal | ' | '' (MySQL also accepts \') |
| Regex | . * + ? ^ $ { } ( ) [ ] | \ / | backslash |
| C / Go / Rust / Java | " \ newline tab | \" \\ \n \t \xHH \uHHHH |
| CSV field | , " newline | wrap in quotes, double the quotes |
| HTML / XML text | & < > " ' | & < > " ' / ' |
| YAML | Anything ambiguous: yes, no, 1.0, leading * or &, colons | Double-quote with JSON escapes |
The shell, specifically
Single quotes are the only fully safe quoting in POSIX shells: nothing inside is interpreted, and the only character that cannot appear is the single quote itself, which is written by ending the quoted string, adding an escaped quote, and starting again: 'it'\''s'. Double quotes still expand $variables, `commands` and \, so they are for when you want expansion. When passing data from code, do not build command lines at all: use an argument array (execve, subprocess.run([...]), exec.Command), and escaping becomes unnecessary.
SQL, specifically
Doubling quotes is correct SQL, but it is not how applications should pass values. Parameterised queries ($1, ?, :name) send the value separately from the statement and make injection impossible. Use the SQL escaper for ad-hoc queries in a console, not in code.
Questions
How do I put a single quote inside a single-quoted shell string?
End the string, add an escaped quote, start again: 'it'\''s'. Or use $'it\'s' in bash/zsh, which supports backslash escapes.
Why does my JSON have \u00e9 instead of é?
Some encoders escape all non-ASCII for safety in 7-bit channels. It is still valid and decodes to the same string. JSON.stringify in JavaScript and json.dumps with ensure_ascii=False in Python keep the characters.
What is the difference between escaping and encoding?
Escaping protects a few special characters so text can sit inside a syntax; encoding (Base64, URL) transforms the whole string into a different alphabet. Base64 and URL encoding are included here because they are often needed in the same breath.
Can I escape for a regex in a specific language?
The regex escaper covers the metacharacters shared by all common engines (PCRE, JavaScript, Python, Go RE2, Java). Inside a character class [] only ] \ ^ and - matter; the tool escapes conservatively so the result works everywhere.