Escape Modifiers
Escape modifiers prepare a field value for a specific output format. Apply them to untrusted syslog text before embedding it in SQL, CSV, HTML, JSON, a URL, a command line, or a file name.
When several modifiers are chained, put the escape last: {MESSAGE|70|EscCMD}.
Modifiers at a Glance
| Modifier | Destination |
|---|---|
SQL string literal (MySQL style: backslash is special) |
|
SQL string literal (ANSI: SQL Server, SQLite) |
|
CSV field, with the quotes in the template |
|
Whole CSV field, safe to open in Excel |
|
HTML text |
|
JSON string |
|
C-style |
|
URL path or query |
|
Windows command-line argument ( |
|
File or folder name |
EscSQL
Prepares a value to be enclosed in single quotes: doubles each ', writes \\ for \, and writes \0 for a NUL byte.
The modifier does not add the surrounding quotes.
If {MESSAGE} is C:\logs 'x', {MESSAGE|EscSQL} is C:\\logs ''x''.
See Export to DB (ODBC) and Report Templates.
EscSQLANSI
Prepares a value to be enclosed in single quotes for databases that follow ANSI SQL, such as SQL Server and SQLite: doubles each ' and removes NUL bytes.
Backslashes are left as they are.
The modifier does not add the surrounding quotes.
If {MESSAGE} is C:\logs 'x', {MESSAGE|EscSQLANSI} is C:\logs ''x''.
EscCSV
Doubles each ".
The modifier does not add the quotes; put them in the template.
If {MESSAGE} is abc "xyz", {MESSAGE|EscCSV} is abc ""xyz"".
Typical CSV line: "{ORIGINATOR_ID|EscCSV}","{MESSAGE|EscCSV}".
See Export to Files.
EscCSV2
Turns a value into a complete CSV field that is safe even when it contains commas, quotes, or line breaks, or starts like a spreadsheet formula.
-
If the value starts with
=,+,-, or@, a tab is prepended so Excel and similar tools treat the cell as text. -
If the value contains
",,, CR, or LF, the result is wrapped in"and each"inside is doubled.
Do not put quotes around {MESSAGE|EscCSV2} in the template; the modifier adds them when needed.
If {MESSAGE} is a,b, {MESSAGE|EscCSV2} is "a,b".
If {MESSAGE} is abc "xyz", {MESSAGE|EscCSV2} is "abc ""xyz""".
If {MESSAGE} is =1+1, {MESSAGE|EscCSV2} is a tab followed by =1+1.
EscHTML
Prepares a value for HTML text or an HTML attribute value. Use it when a template builds HTML, for example an HTML file written by Export to Files or the body of an HTTP request to a service that expects HTML.
| Character | Replaced with |
|---|---|
|
|
|
|
|
|
|
|
|
|
If {MESSAGE} is <b>"Tom" & 'Jerry'</b>, {MESSAGE|EscHTML} is <b>"Tom" & 'Jerry'</b>.
In report templates, do not use EscHTML: report output escapes values itself.
|
EscJSON
Prepares a value for a JSON string.
The modifier does not add the quotes; put {FIELD|EscJSON} inside "…" in the template.
| Character | Replaced with |
|---|---|
|
|
|
|
LF ( |
|
CR ( |
|
TAB ( |
|
BACKSPACE ( |
|
FORM FEED ( |
|
Other control bytes (below 0x20) |
|
If {MESSAGE} is \abc "xyz", {MESSAGE|EscJSON} is \\abc \"xyz\".
See Send HTTP Requests and Export to Files.
EscDBLQ
Inserts \ before each " and \, for a C-style quoted string.
Newlines and other control bytes are not escaped.
For JSON, use EscJSON.
If {MESSAGE} is abc "x\y", {MESSAGE|EscDBLQ} is abc \"x\\y\".
EscURL
Percent-encodes the value for a URL path or query (RFC 3986).
Letters, digits, and - _ . ~ stay as is; every other byte becomes %HH.
See Send HTTP Requests.
EscCMD
Prepares a value as one argument of a Windows command line passed to CreateProcess.
A value without spaces, tabs, line feeds, vertical tabs, or " is left as it is.
Otherwise the value is wrapped in ", each " inside becomes \", and backslashes right before a " or at the end are doubled.
Do not wrap {FIELD|EscCMD} in extra quotes in the template.
If {MESSAGE} is hello, {MESSAGE|EscCMD} is hello.
If {MESSAGE} is hello world, {MESSAGE|EscCMD} is "hello world".
If {MESSAGE} is say "hi", {MESSAGE|EscCMD} is "say \"hi\"".
EscFNAME
Replaces characters that Windows does not allow in a file or folder name with _:
" < > ? * | \ / :, bytes below 0x20, and DEL (0x7F).
See Export to Files.