Top Description Inners Fields Constructors Methods
org.apache.commons.text

public Class StringEscapeUtils

extends Object
Class Inheritance
Imports
java.io.IOException, .Writer, java.util.Collections, .HashMap, .Map, org.apache.commons.lang3.StringUtils, org.apache.commons.text.translate.AggregateTranslator, .CharSequenceTranslator, .CsvTranslators, .EntityArrays, .JavaUnicodeEscaper, .LookupTranslator, .NumericEntityEscaper, .NumericEntityUnescaper, .OctalUnescaper, .UnicodeUnescaper, .UnicodeUnpairedSurrogateRemover

Escapes and unescapes Strings for Java, Java Script, HTML and XML.

#ThreadSafe#

This code has been adapted from Apache Commons Lang 3.5.

Since
1.0

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static class
StringEscapeUtils.Builder

Convenience wrapper for StringBuilder providing escape methods.

pack-priv static class
StringEscapeUtils.XsiUnescaper

Translator object for unescaping backslash escaped entries.

Field Summary

Modifier and TypeField and Description
public static final CharSequenceTranslator
ESCAPE_CSV

Translator object for escaping individual Comma Separated Values.

public static final CharSequenceTranslator
ESCAPE_ECMASCRIPT

Translator object for escaping EcmaScript/JavaScript.

public static final CharSequenceTranslator
ESCAPE_HTML3

Translator object for escaping HTML version 3.0.

public static final CharSequenceTranslator
ESCAPE_HTML4

Translator object for escaping HTML version 4.0.

public static final CharSequenceTranslator
ESCAPE_JAVA

Translator object for escaping Java.

public static final CharSequenceTranslator
ESCAPE_JSON

Translator object for escaping Json.

public static final CharSequenceTranslator
ESCAPE_XML10

Translator object for escaping XML 1.0.

public static final CharSequenceTranslator
ESCAPE_XML11

Translator object for escaping XML 1.1.

public static final CharSequenceTranslator
ESCAPE_XSI

Translator object for escaping Shell command language.

public static final CharSequenceTranslator
UNESCAPE_CSV

Translator object for unescaping escaped Comma Separated Value entries.

public static final CharSequenceTranslator
UNESCAPE_ECMASCRIPT

Translator object for unescaping escaped EcmaScript.

public static final CharSequenceTranslator
UNESCAPE_HTML3

Translator object for unescaping escaped HTML 3.0.

public static final CharSequenceTranslator
UNESCAPE_HTML4

Translator object for unescaping escaped HTML 4.0.

public static final CharSequenceTranslator
UNESCAPE_JAVA

Translator object for unescaping escaped Java.

public static final CharSequenceTranslator
UNESCAPE_JSON

Translator object for unescaping escaped Json.

public static final CharSequenceTranslator
UNESCAPE_XML

Translator object for unescaping escaped XML.

public static final CharSequenceTranslator
UNESCAPE_XSI

Translator object for unescaping escaped XSI Value entries.

Constructor Summary

AccessConstructor and Description
public
StringEscapeUtils()

StringEscapeUtils instances should NOT be constructed in standard programming.

Method Summary

Modifier and TypeMethod and Description
public static StringEscapeUtils.Builder

Returns:

Builder
builder
(final CharSequenceTranslator
the text translator.
translator
)

Gets a Builder.

public static String

Returns:

The input String, enclosed in double quotes if the value contains a comma, newline or double quote, null if null string input.
escapeCsv
(final String
the input CSV column String, may be null.
input
)

Returns a String value for a CSV column enclosed in double quotes, if required.

public static String

Returns:

String with escaped values, null if null string input.
escapeEcmaScript
(final String
String to escape values in, may be null.
input
)

Escapes the characters in a String using EcmaScript String rules.

public static String

Returns:

a new escaped String, null if null string input.
escapeHtml3
(final String
the String to escape, may be null.
input
)

Escapes the characters in a String using HTML entities.

public static String

Returns:

a new escaped String, null if null string input.
escapeHtml4
(final String
the String to escape, may be null.
input
)

Escapes the characters in a String using HTML entities.

public static String

Returns:

String with escaped values, null if null string input.
escapeJava
(final String
String to escape values in, may be null.
input
)

Escapes the characters in a String using Java String rules.

public static String

Returns:

String with escaped values, null if null string input.
escapeJson
(final String
String to escape values in, may be null.
input
)

Escapes the characters in a String using Json String rules.

public static String

Returns:

a new escaped String, null if null string input.
escapeXml10
(final String
the String to escape, may be null.
input
)

Escapes the characters in a String using XML entities.

public static String

Returns:

a new escaped String, null if null string input.
escapeXml11
(final String
the String to escape, may be null.
input
)

Escapes the characters in a String using XML entities.

public static String

Returns:

String with escaped values, null if null string input.
escapeXSI
(final String
String to escape values in, may be null.
input
)

Escapes the characters in a String using XSI rules.

public static String

Returns:

The input String, with enclosing double quotes removed and embedded double quotes unescaped, null if null string input.
unescapeCsv
(final String
the input CSV column String, may be null.
input
)

Returns a String value for an unescaped CSV column.

public static String

Returns:

A new unescaped String, null if null string input.
unescapeEcmaScript
(final String
the String to unescape, may be null.
input
)

Unescapes any EcmaScript literals found in the String.

public static String

Returns:

a new unescaped String, null if null string input.
unescapeHtml3
(final String
the String to unescape, may be null.
input
)

Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

public static String

Returns:

a new unescaped String, null if null string input.
unescapeHtml4
(final String
the String to unescape, may be null.
input
)

Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

public static String

Returns:

a new unescaped String, null if null string input.
unescapeJava
(final String
the String to unescape, may be null.
input
)

Unescapes any Java literals found in the String.

public static String

Returns:

A new unescaped String, null if null string input.
unescapeJson
(final String
the String to unescape, may be null.
input
)

Unescapes any Json literals found in the String.

public static String

Returns:

a new unescaped String, null if null string input.
unescapeXml
(final String
the String to unescape, may be null.
input
)

Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

public static String

Returns:

a new unescaped String, null if null string input.
unescapeXSI
(final String
the String to unescape, may be null.
input
)

Unescapes the characters in a String using XSI rules.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ESCAPE_CSVback to summary
public static final CharSequenceTranslator ESCAPE_CSV

Translator object for escaping individual Comma Separated Values. While escapeCsv(String) is the expected method of use, this object allows the CSV escaping functionality to be used as the foundation for a custom translator.

ESCAPE_ECMASCRIPTback to summary
public static final CharSequenceTranslator ESCAPE_ECMASCRIPT

Translator object for escaping EcmaScript/JavaScript. While escapeEcmaScript(String) is the expected method of use, this object allows the EcmaScript escaping functionality to be used as the foundation for a custom translator.

ESCAPE_HTML3back to summary
public static final CharSequenceTranslator ESCAPE_HTML3

Translator object for escaping HTML version 3.0. While escapeHtml3(String) is the expected method of use, this object allows the HTML escaping functionality to be used as the foundation for a custom translator.

ESCAPE_HTML4back to summary
public static final CharSequenceTranslator ESCAPE_HTML4

Translator object for escaping HTML version 4.0. While escapeHtml4(String) is the expected method of use, this object allows the HTML escaping functionality to be used as the foundation for a custom translator.

ESCAPE_JAVAback to summary
public static final CharSequenceTranslator ESCAPE_JAVA

Translator object for escaping Java. While escapeJava(String) is the expected method of use, this object allows the Java escaping functionality to be used as the foundation for a custom translator.

ESCAPE_JSONback to summary
public static final CharSequenceTranslator ESCAPE_JSON

Translator object for escaping Json. While escapeJson(String) is the expected method of use, this object allows the Json escaping functionality to be used as the foundation for a custom translator.

ESCAPE_XML10back to summary
public static final CharSequenceTranslator ESCAPE_XML10

Translator object for escaping XML 1.0. While escapeXml10(String) is the expected method of use, this object allows the XML escaping functionality to be used as the foundation for a custom translator.

ESCAPE_XML11back to summary
public static final CharSequenceTranslator ESCAPE_XML11

Translator object for escaping XML 1.1. While escapeXml11(String) is the expected method of use, this object allows the XML escaping functionality to be used as the foundation for a custom translator.

ESCAPE_XSIback to summary
public static final CharSequenceTranslator ESCAPE_XSI

Translator object for escaping Shell command language.

See Also
Shell Command Language
UNESCAPE_CSVback to summary
public static final CharSequenceTranslator UNESCAPE_CSV

Translator object for unescaping escaped Comma Separated Value entries. While unescapeCsv(String) is the expected method of use, this object allows the CSV unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_ECMASCRIPTback to summary
public static final CharSequenceTranslator UNESCAPE_ECMASCRIPT

Translator object for unescaping escaped EcmaScript. While unescapeEcmaScript(String) is the expected method of use, this object allows the EcmaScript unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_HTML3back to summary
public static final CharSequenceTranslator UNESCAPE_HTML3

Translator object for unescaping escaped HTML 3.0. While unescapeHtml3(String) is the expected method of use, this object allows the HTML unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_HTML4back to summary
public static final CharSequenceTranslator UNESCAPE_HTML4

Translator object for unescaping escaped HTML 4.0. While unescapeHtml4(String) is the expected method of use, this object allows the HTML unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_JAVAback to summary
public static final CharSequenceTranslator UNESCAPE_JAVA

Translator object for unescaping escaped Java. While unescapeJava(String) is the expected method of use, this object allows the Java unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_JSONback to summary
public static final CharSequenceTranslator UNESCAPE_JSON

Translator object for unescaping escaped Json. While unescapeJson(String) is the expected method of use, this object allows the Json unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_XMLback to summary
public static final CharSequenceTranslator UNESCAPE_XML

Translator object for unescaping escaped XML. While unescapeXml(String) is the expected method of use, this object allows the XML unescaping functionality to be used as the foundation for a custom translator.

UNESCAPE_XSIback to summary
public static final CharSequenceTranslator UNESCAPE_XSI

Translator object for unescaping escaped XSI Value entries. While unescapeXSI(String) is the expected method of use, this object allows the XSI unescaping functionality to be used as the foundation for a custom translator.

Constructor Detail

StringEscapeUtilsback to summary
public StringEscapeUtils()

StringEscapeUtils instances should NOT be constructed in standard programming.

Instead, the class should be used as:

StringEscapeUtils.escapeJava("foo");

This constructor is public to permit tools that require a JavaBean instance to operate.

Method Detail

builderback to summary
public static StringEscapeUtils.Builder builder(final CharSequenceTranslator translator)

Gets a Builder.

Parameters
translator:CharSequenceTranslator

the text translator.

Returns:StringEscapeUtils.Builder

Builder

escapeCsvback to summary
public static String escapeCsv(final String input)

Returns a String value for a CSV column enclosed in double quotes, if required.

If the value contains a comma, newline or double quote, then the String value is returned enclosed in double quotes.

Any double quote characters in the value are escaped with another double quote.

If the value does not contain a comma, newline or double quote, then the String value is returned unchanged.

See Wikipedia and RFC 4180.

Parameters
input:String

the input CSV column String, may be null.

Returns:String

The input String, enclosed in double quotes if the value contains a comma, newline or double quote, null if null string input.

escapeEcmaScriptback to summary
public static String escapeEcmaScript(final String input)

Escapes the characters in a String using EcmaScript String rules.

Escapes any values it finds into their EcmaScript String form. Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.)

So a tab becomes the characters '\\' and 't'.

The only difference between Java strings and EcmaScript strings is that in EcmaScript, a single quote and forward-slash (/) are escaped.

Note that EcmaScript is best known by the JavaScript and ActionScript dialects.

Example:

input string: He didn't say, "Stop!"
output string: He didn\'t say, \"Stop!\"

Security Note

We only provide backslash escaping in this method. For example, '\"' has the output '\\\"' which could result in potential issues in the case where the string being escaped is being used in an HTML tag like <select onmouseover="..." />. If you wish to have more rigorous string escaping, you may consider the ESAPI Libraries. Further, you can view the ESAPI GitHub Org.

Parameters
input:String

String to escape values in, may be null.

Returns:String

String with escaped values, null if null string input.

escapeHtml3back to summary
public static String escapeHtml3(final String input)

Escapes the characters in a String using HTML entities.

Supports only the HTML 3.0 entities.

Parameters
input:String

the String to escape, may be null.

Returns:String

a new escaped String, null if null string input.

escapeHtml4back to summary
public static String escapeHtml4(final String input)

Escapes the characters in a String using HTML entities.

For example:

"bread" & "butter"

becomes:

"bread" & "butter".

Supports all known HTML 4.0 entities, including funky accents. Note that the commonly used apostrophe escape character (&apos;) is not a legal entity and so is not supported).

Parameters
input:String

the String to escape, may be null.

Returns:String

a new escaped String, null if null string input.

See Also
ISO Entities, HTML 3.2 Character Entities for ISO Latin-1, HTML 4.0 Character entity references, HTML 4.01 Character References, HTML 4.01 Code positions
escapeJavaback to summary
public static String escapeJava(final String input)

Escapes the characters in a String using Java String rules.

Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.)

So a tab becomes the characters '\\' and 't'.

The only difference between Java strings and JavaScript strings is that in JavaScript, a single quote and forward-slash (/) are escaped.

Example:

input string: He didn't say, "Stop!"
output string: He didn't say, \"Stop!\"
Parameters
input:String

String to escape values in, may be null.

Returns:String

String with escaped values, null if null string input.

escapeJsonback to summary
public static String escapeJson(final String input)

Escapes the characters in a String using Json String rules.

Escapes any values it finds into their Json String form. Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.)

So a tab becomes the characters '\\' and 't'.

The only difference between Java strings and Json strings is that in Json, forward-slash (/) is escaped.

See http://www.ietf.org/rfc/rfc4627.txt for further details.

Example:

input string: He didn't say, "Stop!"
output string: He didn't say, \"Stop!\"
Parameters
input:String

String to escape values in, may be null.

Returns:String

String with escaped values, null if null string input.

escapeXml10back to summary
public static String escapeXml10(final String input)

Escapes the characters in a String using XML entities.

For example: "bread" & "butter" => "bread" & "butter".

Note that XML 1.0 is a text-only format: it cannot represent control characters or unpaired Unicode surrogate code points, even after escaping. escapeXml10 will remove characters that do not fit in the following ranges:

#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]

Though not strictly necessary, escapeXml10 will escape characters in the following ranges:

[#x7F-#x84] | [#x86-#x9F]

The returned string can be inserted into a valid XML 1.0 or XML 1.1 document. If you want to allow more non-text characters in an XML 1.1 document, use escapeXml11(String).

Parameters
input:String

the String to escape, may be null.

Returns:String

a new escaped String, null if null string input.

See Also
unescapeXml(String)
escapeXml11back to summary
public static String escapeXml11(final String input)

Escapes the characters in a String using XML entities.

For example: "bread" & "butter" => "bread" & "butter".

XML 1.1 can represent certain control characters, but it cannot represent the null byte or unpaired Unicode surrogate code points, even after escaping. escapeXml11 will remove characters that do not fit in the following ranges:

[#x1-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]

escapeXml11 will escape characters in the following ranges:

[#x1-#x8] | [#xB-#xC] | [#xE-#x1F] | [#x7F-#x84] | [#x86-#x9F]

The returned string can be inserted into a valid XML 1.1 document. Do not use it for XML 1.0 documents.

Parameters
input:String

the String to escape, may be null.

Returns:String

a new escaped String, null if null string input.

See Also
unescapeXml(String)
escapeXSIback to summary
public static String escapeXSI(final String input)

Escapes the characters in a String using XSI rules.

Beware! In most cases you don't want to escape shell commands but use multi-argument methods provided by ProcessBuilder or Runtime#exec(String[]) instead.

Example:

input string: He didn't say, "Stop!"
output string: He\ didn\'t\ say,\ \"Stop!\"
Parameters
input:String

String to escape values in, may be null.

Returns:String

String with escaped values, null if null string input.

See Also
Shell Command Language
unescapeCsvback to summary
public static String unescapeCsv(final String input)

Returns a String value for an unescaped CSV column.

If the value is enclosed in double quotes, and contains a comma, newline or double quote, then quotes are removed.

Any double quote escaped characters (a pair of double quotes) are unescaped to just one double quote.

If the value is not enclosed in double quotes, or is and does not contain a comma, newline or double quote, then the String value is returned unchanged.

see Wikipedia and RFC 4180.
Parameters
input:String

the input CSV column String, may be null.

Returns:String

The input String, with enclosing double quotes removed and embedded double quotes unescaped, null if null string input.

unescapeEcmaScriptback to summary
public static String unescapeEcmaScript(final String input)

Unescapes any EcmaScript literals found in the String.

For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

Parameters
input:String

the String to unescape, may be null.

Returns:String

A new unescaped String, null if null string input.

See Also
unescapeJava(String)
unescapeHtml3back to summary
public static String unescapeHtml3(final String input)

Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes. Supports only HTML 3.0 entities.

Parameters
input:String

the String to unescape, may be null.

Returns:String

a new unescaped String, null if null string input.

unescapeHtml4back to summary
public static String unescapeHtml4(final String input)

Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes. Supports HTML 4.0 entities.

For example, the string "<Français>" will become "<Fran�ais>"

If an entity is unrecognized, it is left alone, and inserted verbatim into the result string. e.g. ">&zzzz;x" will become ">&zzzz;x".

Parameters
input:String

the String to unescape, may be null.

Returns:String

a new unescaped String, null if null string input.

unescapeJavaback to summary
public static String unescapeJava(final String input)

Unescapes any Java literals found in the String. For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

Parameters
input:String

the String to unescape, may be null.

Returns:String

a new unescaped String, null if null string input.

unescapeJsonback to summary
public static String unescapeJson(final String input)

Unescapes any Json literals found in the String.

For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

Parameters
input:String

the String to unescape, may be null.

Returns:String

A new unescaped String, null if null string input.

See Also
unescapeJava(String)
unescapeXmlback to summary
public static String unescapeXml(final String input)

Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

Supports only the five basic XML entities (gt, lt, quot, amp, apos). Does not support DTDs or external entities.

Note that numerical \\u Unicode codes are unescaped to their respective Unicode characters. This may change in future releases.

Parameters
input:String

the String to unescape, may be null.

Returns:String

a new unescaped String, null if null string input.

See Also
escapeXml10(String), escapeXml11(String)
unescapeXSIback to summary
public static String unescapeXSI(final String input)

Unescapes the characters in a String using XSI rules.

Parameters
input:String

the String to unescape, may be null.

Returns:String

a new unescaped String, null if null string input.

See Also
StringEscapeUtils#escapeXSI(String)
org.apache.commons.text back to summary

public final Class StringEscapeUtils.Builder

extends Object
Class Inheritance

Convenience wrapper for StringBuilder providing escape methods.

Example:

new Builder(ESCAPE_HTML4)
     .append("<p>")
     .escape("This is paragraph 1 and special chars like & get escaped.")
     .append("</p><p>")
     .escape("This is paragraph 2 & more...")
     .append("</p>")
     .toString()

Field Summary

Modifier and TypeField and Description
private final StringBuilder
sb

StringBuilder to be used in the Builder class.

private final CharSequenceTranslator
translator

CharSequenceTranslator to be used in the Builder class.

Constructor Summary

AccessConstructor and Description
private
Builder(final CharSequenceTranslator
a CharSequenceTranslator.
translator
)

Builder constructor.

Method Summary

Modifier and TypeMethod and Description
public StringEscapeUtils.Builder

Returns:

this, to enable chaining
append
(final String
the String to append
input
)

Literal append, no escaping being done.

public StringEscapeUtils.Builder

Returns:

this, to enable chaining
escape
(final String
the String to escape
input
)

Escape input according to the given CharSequenceTranslator.

public String

Returns:

The escaped string
toString
()

Overrides java.lang.Object.toString.

Return the escaped string.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAllwaitwaitwait

Field Detail

sbback to summary
private final StringBuilder sb

StringBuilder to be used in the Builder class.

translatorback to summary
private final CharSequenceTranslator translator

CharSequenceTranslator to be used in the Builder class.

Constructor Detail

Builderback to summary
private Builder(final CharSequenceTranslator translator)

Builder constructor.

Parameters
translator:CharSequenceTranslator

a CharSequenceTranslator.

Method Detail

appendback to summary
public StringEscapeUtils.Builder append(final String input)

Literal append, no escaping being done.

Parameters
input:String

the String to append

Returns:StringEscapeUtils.Builder

this, to enable chaining

escapeback to summary
public StringEscapeUtils.Builder escape(final String input)

Escape input according to the given CharSequenceTranslator.

Parameters
input:String

the String to escape

Returns:StringEscapeUtils.Builder

this, to enable chaining

toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Return the escaped string.

Returns:String

The escaped string

Annotations
@Override
org.apache.commons.text back to summary

pack-priv Class StringEscapeUtils.XsiUnescaper

extends CharSequenceTranslator
Class Inheritance

Translator object for unescaping backslash escaped entries.

Field Summary

Modifier and TypeField and Description
private static final char
BACKSLASH

Escaped backslash constant.

Constructor Summary

AccessConstructor and Description
pack-priv

Method Summary

Modifier and TypeMethod and Description
public int
translate(final CharSequence input, final int index, final Writer writer)

Implements abstract org.apache.commons.text.translate.CharSequenceTranslator.translate.

Translate a set of code points, represented by an int index into a CharSequence, into another set of code points.

Inherited from org.apache.commons.text.translate.CharSequenceTranslator:
hextranslatetranslatewith

Field Detail

BACKSLASHback to summary
private static final char BACKSLASH

Escaped backslash constant.

Constructor Detail

XsiUnescaperback to summary
pack-priv XsiUnescaper()

Method Detail

translateback to summary
public int translate(final CharSequence input, final int index, final Writer writer) throws IOException

Implements abstract org.apache.commons.text.translate.CharSequenceTranslator.translate.

Doc from org.apache.commons.text.translate.CharSequenceTranslator.translate.

Translate a set of code points, represented by an int index into a CharSequence, into another set of code points. The number of code points consumed must be returned, and the only IOExceptions thrown must be from interacting with the Writer so that the top level API may reliably ignore StringWriter IOExceptions.

Annotations
@Override
Exceptions
IOException:
if and only if the Writer produces an IOException.