Code Sanitizer Formatter🔒 100% local
Clean code snippets. Privacy-first, no server uploads, no tracking.
Escapes one value for nine different output contexts in a single pass - HTML text, HTML attributes, a JavaScript single-quoted literal, a JSON string, a URL query component, a regex source, a POSIX shell argument, an SQL literal and CSS - plus a tags-stripped version and a filename slug. It also reports which attack shapes it recognises (tags, event handlers or eval, SQL metacharacters, newlines) so you know what you are holding. Your input is treated purely as text: no escaping step is evaluated as code.
How to use it
- Paste the value as it currently exists - a name, a query string, a payload you are testing with.
- Press Process.
- Pick the row whose heading matches where the value actually lands, and ignore the rest.
Worked example
Tom & Jerry'sbecomesSanitised output for each context — 13 input chars.
Findings:
• Contains SQL metacharacters (quote, comment, OR 1=1, UNION SELECT) — suspicious for injection.
1. HTML body / text node (escape everything):
Tom & Jerry's
2. HTML attribute value ("quoted"):
Tom & Jerry's
3. JavaScript string literal (single quotes):
Tom & Jerry\'s
4. JSON string value:
"Tom & Jerry's"
5. URL query component:
Tom%20%26%20Jerry's
6. RegExp source (escaped so it matches literally):
Tom & Jerry's
7. Shell (single-quoted, POSIX-safe):
'Tom & Jerry'\''s'
8. SQL string literal (quote doubled — but use PARAMETERS, not string building):
Tom & Jerry''s
9. CSS identifier/value:
Tom \0026 Jerry\0027 s
Bonus — tags stripped entirely (for rich-text fields where escaping is not an option):
Tom & Jerry's
Suggested filename slug: tom-jerry-s
Reminder: escaping is context-specific. HTML escaping does NOT protect an SQL query or a JS string — always pick the row that matches where the value lands.The single quote alone is enough to raise the SQL-metacharacter finding. Note how the same input needs four different strings across the rows; the shell row wraps in single quotes and escapes the embedded one.
When to use it
- Embedding user-supplied text into a shell command, a JSON body or an inbox header and wanting the escaping right the first time.
- Building a fixture of injection payloads and needing each encoding side by side.
- Showing a reviewer exactly what a value becomes after escaping.
What it does not do
- Escaping is not the fix for injection: parameterised queries, DOM APIs and context-aware frameworks are. This page shows you the escaped string, it does not make the surrounding code safe.
- The tool cannot know which context your value reaches, so choosing the wrong row leaves the hole open.
- No sanitiser library is applied - the stripped-tags row deletes anything between angle brackets, which is blunt and no substitute for DOMPurify on rich text.
- The findings are keyword heuristics: a quote in ordinary prose trips the SQL warning, and an obfuscated payload can slip past undetected.