Glossary

JavaScript escaping

Representing characters so that text can be carried safely and unambiguously inside JavaScript source code.

Definition

JavaScript string escaping replaces characters that have syntactic or control meaning with escape sequences. A line break can be written as \n, a quotation mark as \", and a Unicode code point as \uXXXX or \u{...}.

const message = "First line\nSecond line";
const symbol = "\u{1F600}";

Do not confuse three different operations

String escaping

Creates valid source or data-string representations such as \n and \uXXXX.

Legacy escape()

Produces %XX and %uXXXX. It is deprecated.

URI encoding

Represents UTF-8 bytes as percent-encoded sequences for URIs and components.

Security boundary

Escaping is contextual. A representation suitable for a JavaScript string is not automatically safe for HTML, a URL, CSS or a database query. Always choose the encoding required by the destination context.