Convert a string into a POSIX sh-safe single argument literal.
Escapes a JavaScript string so it can be safely used as a single argument
in POSIX-compatible shells (sh, bash, zsh, dash, etc.). The result, when
parsed by the shell, produces exactly one argument with the original content.
Escaping Strategy
Safe strings are returned as-is: Plain alphanumeric, Japanese, emoji,
and other "harmless" Unicode characters pass through unchanged.
Unsafe strings are single-quoted: Wraps in '...' with internal '
escaped as '\'' (close, escaped quote, reopen).
// Strings with spaces or special chars are quoted shellEscapeArg("a b") // "'a b'" shellEscapeArg("$HOME") // "'$HOME'" shellEscapeArg("*.txt") // "'*.txt'"
Example
// Single quotes are escaped with '\'' shellEscapeArg("O'Reilly") // "'O'\\''Reilly'"
Convert a string into a POSIX sh-safe single argument literal.
Escapes a JavaScript string so it can be safely used as a single argument in POSIX-compatible shells (sh, bash, zsh, dash, etc.). The result, when parsed by the shell, produces exactly one argument with the original content.
Escaping Strategy
'...'with internal'escaped as'\''(close, escaped quote, reopen).When Quoting is Required
' " \ $ \| & ; < > ( ) * ? [ ] { } ! #`~(prevents tilde expansion)Limitations
--dangerous-flag).