SQL String Unescape
Convert escaped SQL string literals back to raw text — MySQL backslash escapes, PostgreSQL '' doubling and E'' strings, SQL Server quote-doubling. Auto-detect dialect, double-escape warnings, round-trip verification. Free, instant, and 100% client-side: your text never leaves your browser.
Honest disclaimer: unescaping is a formatting aid, not a security boundary. Unescaping a string does not make it safe for SQL — for application code, parameterized queries (prepared statements) are always safer. Use this tool for reading debug output, logs, seed data, and migrations — never as your app's injection defense.
0 characters
sequences collapsed: 0
input: 0 chars
output: 0 chars
delta: +0
| # | Escaped form | Becomes |
|---|---|---|
| Type something above to see each escape sequence's transformation. | ||
How to use the SQL unescape tool
- Pick a dialect — or leave Auto-detect on. MySQL decodes backslash escapes (
\'\\\n\r\0\Z) and also accepts''as an alternate quote escape. PostgreSQL / ANSI only collapses''to'(backslash is literal data), except insideE'...'strings. SQL Server collapses'', with an optional]]→]toggle for bracket identifiers. - Paste your escaped string — or click an example preset to try instantly. Conversion is live. Keep "Strip surrounding quotes" on if you paste a full literal like
'O''Brien'orE'price:\n$5'. - Read the warnings honestly. If the result still looks escaped, the input was probably escaped twice — confirm "Unescape again" yourself; the tool never unescapes twice silently. If backslashes vanished, MySQL's "unknown sequence" rule simplified them (shown in the status line). The round-trip line tells you whether re-escaping reproduces your input exactly.
- Copy or download the raw text. The stats bar shows how many escape sequences were collapsed.
Per-sequence unescape reference
| Escaped form | Becomes | MySQL | PostgreSQL / ANSI | SQL Server | Notes |
|---|---|---|---|---|---|
| \' | ' | ✓ | literal \' (backslash is data) | literal | Auto-detect treats a backslash sequence as MySQL |
| '' | ' | ✓ (alternate form) | ✓ | ✓ | Re-escaping normalizes '' to \' in MySQL mode |
| \\ | \ | ✓ | literal | literal | — |
| \n \t \r \b | newline, tab, CR, backspace | ✓ | literal | literal | Real control characters in the output |
| \0 \Z | NUL, SUB (Ctrl+Z) | ✓ | literal | literal | — |
| \" | " | ✓ | literal | literal | — |
| ]] | ] | literal | literal | ✓ (optional toggle) | QUOTENAME-style [identifier] unescaping |
| \q (unknown) | q + warning | simplified per MySQL | n/a | n/a | MySQL drops the backslash before unrecognized chars |
MySQL rules mirror mysql_real_escape_string semantics. PostgreSQL assumes standard_conforming_strings=on (default since 9.1); E'...' strings additionally decode backslash escapes.
Worked examples
| # | Escaped input | Dialect | Unescaped result | Notes |
|---|---|---|---|---|
| 1 | O\'Brien | MySQL | O'Brien | The classic case, reversed |
| 2 | C:\\Users\\Rafsan | MySQL | C:\Users\Rafsan | Doubled backslashes collapse |
| 3 | 'O''Brien' | PostgreSQL + strip quotes | O'Brien | Full literal: quotes stripped first |
| 4 | x'' OR ''1''=''1 | PostgreSQL / SQL Server | x' OR '1'='1 | Four '' pairs collapse |
| 5 | E'price:\n$5' | PostgreSQL + strip quotes | price: ⏎ $5 | E-string: \n becomes a real newline |
| 6 | O\\'Brien | MySQL | O\'Brien | Double-escaped: warning shown, "Unescape again" → O'Brien |
| 7 | [Sales]] | SQL Server + ]] toggle | [Sales] | Bracket identifier unescaping |
| 8 | O''Brien | MySQL | O'Brien | MySQL also accepts ''; re-escape normalizes it to \' |
All examples above are machine-verified against the tool's engine (28 automated test vectors).
Frequently asked questions
It converts escaped text back into the raw characters it represents: backslash sequences like \n or \' become real newlines and quotes (MySQL style), and doubled quotes like '' become a single ' (PostgreSQL and SQL Server style). It is the exact reverse of our SQL String Escape tool — unescaping its output returns the original text, which the round-trip indicator on this page verifies automatically.
Because the escaping rules differ. MySQL uses backslash escapes (\n, \', \\, \0, \Z) — a backslash starts an escape sequence. PostgreSQL with standard_conforming_strings=on and SQL Server use only the doubled single quote '', where a backslash is ordinary data. Unescaping with the wrong dialect corrupts your text (for example, treating C:\path as an escape sequence when it is literal data). When unsure, use Auto-detect: the tool picks MySQL if it sees backslash sequences, PostgreSQL/ANSI if it sees '' doubling.
Double-escaping means the text was escaped twice — for example O\\'Brien instead of O\'Brien. Unescaping once then yields O\'Brien, which still looks escaped. This tool never silently unescapes twice; instead it shows a warning ("still looks escaped") with an "Unescape again" button so you confirm the second pass yourself. Unescaping is potentially lossy, and the tool is honest about that: the round-trip indicator tells you whether re-escaping reproduces your input.
That is genuine MySQL behavior, not a tool bug: in MySQL, a backslash before an unrecognized character is dropped, so \q becomes q. The tool follows MySQL here, but unlike MySQL it warns you — every simplified sequence is counted and shown in the status line, and the round-trip check will flag the mismatch. If your backslashes are literal data (for example Windows paths), switch to PostgreSQL / ANSI mode, where backslashes pass through untouched.
No — and the reverse is true too: neither escaping nor unescaping is a security boundary. Unescaping is a formatting aid for reading debug output, logs, and stored literals. For application code, always use parameterized queries (prepared statements), which keep data and SQL code separate. Use this tool for scripts, seed data, migrations, and debugging — never as your app's injection defense.
Enable "Strip surrounding quotes" and the tool understands prefixes: E'...' is PostgreSQL's legacy escape-string syntax, where backslash sequences are interpreted (standard_conforming_strings=off style). N'...' is the national-character prefix used by SQL Server and MySQL. The prefix is removed, the body is unescaped with the matching rules, and the detected prefix is shown in the status line.
Because real MySQL accepts both forms: a quote inside a MySQL string literal can be written as \' or as ''. This tool handles both, which most online unescapers do not. Note that re-escaping normalizes '' to the backslash form \', so the round-trip indicator honestly reports a mismatch for that input — the data is identical, only the representation changed.
No. All unescaping runs entirely in your browser with JavaScript — your text never leaves your device. You can disconnect from the internet after the page loads and the tool keeps working.
Free tool by NRTechStudio