JavaScript escape() and unescape(): Legacy Reference

The global escape() and unescape() functions are legacy/deprecated. Keep them only when maintaining old code. For new URL encoding work, use encodeURI(), encodeURIComponent() and their matching decode functions.

const value = "name=Subhendu Mohapatra & city=Hyderabad";
console.log(encodeURIComponent(value));

Show Table of Contents ↓

What escape() did Top ↑

const text = "A B+C";
console.log(escape(text)); // legacy only

escape() creates old-style percent/Unicode escape sequences and should not be chosen for new applications.

What unescape() did Top ↑

const encoded = escape("A B+C");
console.log(unescape(encoded)); // legacy pair

unescape() is the corresponding legacy decoder.

encodeURI() for a complete URI Top ↑

const url = "https://example.com/search?q=hello world";
console.log(encodeURI(url));

encodeURI() preserves characters that have structural meaning in a URI.

encodeURIComponent() for one component Top ↑

const query = "JavaScript strings & arrays";
const url = "https://example.com/search?q=" + encodeURIComponent(query);
console.log(url);

Decode the matching format Top ↑

const encoded = encodeURIComponent("A&B");
console.log(decodeURIComponent(encoded)); // A&B

Encoding is not sanitization Top ↑

URL encoding does not make arbitrary input safe for HTML, SQL, JavaScript, or another context. Use the escaping/validation appropriate to the destination context.

← Previous / String Reference Next related topic →

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: