diff --git a/datasette/utils/__init__.py b/datasette/utils/__init__.py
index bdae5653..c2578677 100644
--- a/datasette/utils/__init__.py
+++ b/datasette/utils/__init__.py
@@ -271,7 +271,7 @@ _boring_keyword_re = re.compile(r"^[a-zA-Z_][a-zA-Z0-9_]*$")
 
 
 def escape_css_string(s):
-    return _css_re.sub(lambda m: "\\{:X}".format(ord(m.group())), s)
+    return _css_re.sub(lambda m: "\\" + ("{:X}".format(ord(m.group())).zfill(6)), s)
 
 
 def escape_sqlite(s):
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 73001f0d..9f666386 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -420,6 +420,17 @@ def test_escape_fts(query, expected):
     assert expected == utils.escape_fts(query)
 
 
+@pytest.mark.parametrize(
+    "input,expected",
+    [
+        ("dog", "dog"),
+        ('dateutil_parse("1/2/2020")', r"dateutil_parse(\0000221/2/2020\000022)"),
+    ],
+)
+def test_escape_css_string(input, expected):
+    assert expected == utils.escape_css_string(input)
+
+
 def test_check_connection_spatialite_raises():
     path = str(pathlib.Path(__file__).parent / "spatialite.db")
     conn = sqlite3.connect(path)