JSON, HTML, URLs and Base64 solve different representation problems. A string that is valid for one grammar may remain broken or unsafe in another, even when the visible result contains many escape characters.

Match the destination parser

Use JSON escaping only when text becomes one JSON string value. Use HTML character references for text represented in HTML syntax, percent-encoding for URL components under their URL rules, and Base64 when bytes need a textual alphabet. These transforms are not interchangeable: a JSON reverse-solidus escape has no special protective meaning to an HTML parser, and a percent sign does not replace JSON quotation rules.

Encoding is not sanitization or trust

Escaping preserves data across one syntax boundary; it does not decide whether decoded text may be executed, rendered or used in a query. Keep data separate from commands and templates, use parameterized APIs for SQL, native text bindings for HTML, and the destination platform’s own security model. EscapeJSON intentionally returns plain text, never inserts it as markup and never claims that a successful transform validates the surrounding payload.

Verify the destination and layer count

Compare the result with the producer and destination contracts. JSON escaping protects only one JSON string grammar; it does not sanitize HTML, SQL, JavaScript, shell input or another parser. Decode one reviewed layer at a time, reject malformed Unicode, and keep a known fixture for important integrations.