🐚Dev

Shell Argument Escaper

Quote a string safely for bash/sh, wrapping in single quotes and handling embedded quotes.

Text

Saída segura para shell (aspas simples):

Escaping a shell argument with single quotes

Paste the text and the page returns the safe way to pass it as a single shell argument. The technique is to wrap everything in single quotes and handle the single quote itself in a specific way: close the quoting, emit a backslash-escaped quote, and reopen. It is ugly to read and it is the correct approach.

The reason for choosing single quotes is that inside them the POSIX shell interprets nothing — not a variable, not command substitution, not even the backslash. There is no escape inside single quotes, and that absence is what makes the quoting predictable: any byte, including a newline, a dollar sign, a backtick or a semicolon, passes through literally.

The comparison with double quotes explains the rest. Inside those, dollar, backtick and backslash stay active, so text arriving from outside can execute a command. That is the difference between passing an odd filename and opening a shell injection. When the text comes from a user, a log or a database, single quotes with this escape is the pattern to follow.

Frequently asked questions

Why not backslash each special character?

Because the list of special characters depends on the shell and the context, and missing one is enough to open a hole. Single quotes reverse the burden: instead of enumerating what is dangerous, you declare that nothing is interpreted. Only the quote itself needs handling, and it is a single known case.

Is there a byte you cannot pass?

Only the zero byte, and not because of a limitation in the quoting: the system uses zero to mark the end of each argument, so it cannot appear inside one. Newlines, tabs and control characters pass without trouble inside single quotes.

Does this apply to PowerShell and cmd?

No. Windows quoting rules are different, and cmd has its own peculiarities with quotes and the caret. This form applies to POSIX shells — sh, bash, zsh, dash. When generating a command line for another platform, use that platform's quoting.

Related Tools

💲

Bash PS1 Generator

Compose PS1 with ANSI colors, user, host, pwd, git branch and last exit code. Live prompt preview.

🔤

JavaScript Escape / Unescape

Escape JavaScript strings by adding backslashes before special characters and convert back to the original.

🔤

XML Escape / Unescape

Escape special XML characters (<, >, &, ", ') to entities and convert XML entities back to text.

🐚

Minimal .zshrc Generator

Build a lean .zshrc without Oh My Zsh: history, completion, simple prompt with git branch and PATH.

📂

Bash/Zsh Aliases Generator

Predefined list of useful aliases (ll, la, gs, gd, gco, mkcd, ip) ready to paste into .bashrc or .zshrc.

🔤

HTML Escape / Unescape

Escape special HTML characters (<, >, &, ", ') to HTML entities and convert entities back to text.