A JSON string is a quoted value with a small, exact escape grammar. EscapeJSON treats raw text, a quoted literal and inner escaped content as three different things so the conversion never depends on guessing.

Characters that must be escaped

RFC 8259 requires a quotation mark, reverse solidus and every control character from U+0000 through U+001F to be escaped inside a string. Newline, tab, carriage return, backspace and form feed have short spellings; another control uses four hexadecimal digits after \u. A solidus may be escaped but does not have to be. Printable Unicode can remain readable when the destination accepts Unicode.

Quoted value versus inner content

A complete JSON string starts and ends with double quotes. Inner content is only the text between those quotes, with its required escape sequences still present. EscapeJSON makes this choice explicit in both directions. The decoder accepts exactly one selected form, rejects raw controls and unexpected quotes, and never repairs an incomplete escape. That keeps the copied result predictable for the parser that will receive it.

Verify the destination and layer count

Compare the result with the producer and destination contracts. JSON escaping protects only one JSON string grammar; it does not sanitize HTML, SQL, JavaScript, shell input or another parser. Decode one reviewed layer at a time, reject malformed Unicode, and keep a known fixture for important integrations.