Escape Modifiers

Escape modifiers prepare a field value for a specific output format. Apply them to untrusted syslog text before embedding it in SQL, CSV, HTML, JSON, a URL, a command line, or a file name.

When several modifiers are chained, put the escape last so the escaped form is what the destination sees: {MESSAGE|70|EscCMD}.

Which Modifier

Destination Modifier Quotes in the template

SQL string literal

EscSQL

Wrap in '…​'

CSV field (quotes already in the template)

EscCSV

Wrap in "…​"

CSV field (quotes and formula guard in the value)

EscCSV2

Do not wrap

HTML text

EscHTML

JSON string

EscJSON

Wrap in "…​"

C-style "…​" string

EscDBLQ

Wrap in "…​"

URL path or query

EscURL

Windows CreateProcess argument

EscCMD

Do not wrap

File or folder name

EscFNAME

EscSQL

Prepares a value to be enclosed in single quotes: duplicates ', writes \\ for \, and writes \0 for a NUL byte. The modifier does not add the surrounding quotes.

If {MESSAGE} is abc 'xyz', {MESSAGE|EscSQL} is abc ''xyz''.

See Export to DB (ODBC) and Report Templates.

EscCSV

Duplicates each ". The modifier does not add surrounding quotes — the template supplies them.

If {MESSAGE} is abc "xyz", {MESSAGE|EscCSV} is abc ""xyz"".

Typical CSV line: "{ORIGINATOR_ID|EscCSV}","{MESSAGE|EscCSV}".

See Export to Files.

EscCSV2

Safer CSV cell for values that may contain commas, quotes, line breaks, or spreadsheet formula prefixes.

  • If the value starts with =, +, -, or @, a tab is prepended so Excel and similar tools treat the cell as text.

  • If the value contains ", ,, CR, or LF, the result is wrapped in " and internal " are doubled.

  • Otherwise the value is left as-is (aside from the tab, when that rule applied).

Do not add extra quotes in the template — {MESSAGE|EscCSV2} is the whole cell.

If {MESSAGE} is a,b, {MESSAGE|EscCSV2} is "a,b".
If {MESSAGE} is abc "xyz", {MESSAGE|EscCSV2} is "abc ""xyz""".
If {MESSAGE} is =1+1, {MESSAGE|EscCSV2} is a tab followed by =1+1.

EscHTML

Prepares a value for HTML text.

Character Replaced with

&

&

<

<

>

>

"

"

'

'

EscJSON

Prepares a value for JSON text. The modifier does not add surrounding quotes — put {FIELD|EscJSON} inside "…​" in the template.

Character Replaced with

\

\\

"

\"

LF (\n)

\n

CR (\r)

\r

TAB (\t)

\t

BACKSPACE (\b)

\b

FORM FEED (\f)

\f

Other control bytes (below 0x20)

\u00XX

If {MESSAGE} is \abc "xyz", {MESSAGE|EscJSON} is \\abc \"xyz\".

See Send HTTP Requests and Export to Files.

EscDBLQ

Inserts \ before each " and \, for a C-style quoted string. Newlines and other control bytes are not escaped — use EscJSON when the destination is JSON.

If {MESSAGE} is abc "x\y", {MESSAGE|EscDBLQ} is abc \"x\\y\".

EscURL

Percent-encodes the value for a URL path or query (RFC 3986). Letters, digits, and - _ . ~ stay as is; every other byte becomes %HH.

See Send HTTP Requests.

EscCMD

Prepares a value for a Windows command line passed to CreateProcess. Adds surrounding " when the value contains a space, tab, LF, vertical tab, or ". Consecutive \ immediately before " or at the end of the value are doubled so CreateProcess keeps them.

Do not wrap {FIELD|EscCMD} in extra quotes in the template.

If {MESSAGE} is hello, {MESSAGE|EscCMD} is hello.
If {MESSAGE} is hello world, {MESSAGE|EscCMD} is "hello world".

See Execute Program/Script.

EscFNAME

Replaces characters that Windows does not allow in a file or folder name with _: " < > ? * | \ / :, bytes below 0x20, and DEL (0x7F).

See Export to Files.

Related Topics