cURL Command Builder — Generate curl Commands from a Form

Hand-writing a curl command with multiple headers and a JSON body means juggling quote characters, escaping, and line-continuation backslashes — and one misplaced quote silently breaks the whole command. This snippet flips that process around: fill in a method, a URL, a list of headers, and a JSON body through ordinary form fields, and it assembles a correctly shell-escaped curl command as you type, ready to paste straight into a terminal.

Why every value goes through shellEscape()

The single most important function in this tool is shellEscape(), which wraps every dynamic value — the URL, each header's key: value pair, and the JSON body — in single quotes, and handles the one tricky case: a literal single quote appearing inside a value. POSIX shells cannot escape a quote character *inside* single quotes directly, so the standard trick is used: close the quote, insert an escaped single quote, then reopen the quote ('\''). Every value passed through shellEscape() is safe to paste into bash, zsh, or any POSIX-compatible shell without breaking the command or allowing accidental shell injection, regardless of what punctuation the header value or JSON body contains.

Method flag omitted for GET, matching curl's actual default

The -X method flag is only added when the method is not GET, because curl defaults to GET and explicitly adding -X GET is both redundant and, in one curl-specific edge case, can subtly change how a request with a body is sent. This mirrors what an experienced engineer writing curl commands by hand would actually do — omit flags that aren't needed rather than including every option unconditionally.

Headers as an editable array with a default useful pair

Headers are stored as an array of { key, value } objects, pre-populated with a realistic Content-Type: application/json and Authorization: Bearer YOUR_TOKEN pair since those two headers appear in the overwhelming majority of authenticated JSON API requests. Each header contributes its own -H flag with the shell-escaped "key: value" string, and empty-key rows are silently skipped when building the command so an in-progress blank row never corrupts the output.

Live JSON validation on the body without blocking the command

The body textarea is validated with JSON.parse() inside a try/catch purely for feedback — an invalid JSON body highlights the textarea in red as a warning, but the command is still generated and includes the -d flag with whatever text is present. This is a deliberate choice: sometimes a request body is intentionally not strict JSON (form-encoded data, a GraphQL query string, or a body under active editing), so validation should warn without ever blocking output.

Pretty-print mode for multi-line readability

Toggling "multi-line" changes the separator between each part of the command from a plain space to \\\n — a trailing backslash followed by a newline and indentation, which is the standard shell line-continuation syntax. This produces a command that reads cleanly across multiple lines in documentation or a README, functionally identical to the single-line version when pasted into a terminal, since the shell treats a backslash-newline sequence as if it were not there at all.