JSONObject::quote(). Why special case for "</" but not "/" about json-java HOT 5 CLOSED

There is no requirement to escape /, but it may be escaped. This is useful when embedding JSON in HTML.

from json-java.

I thought the grammar: http://json.org/ required it to be escaped. It's in the same list and no different from \b, \t, , etc. I'm worried about parser interoperability between different platforms like Java generated JSON on C++...

from json-java.

You are mistaken.

from json-java.

No he is right. JsonObject DOES quote forward slashes in JsonStringer.string(String value) method.

from json-java.

@Doogiemuc the forward slash escape is technically optional in the JSON spec, which is what Douglas was talking about. The reason that this library escapes them is because embedding JSON directly into HTML can cause "remote code execution" issues when you don't escape them. We escape them by default for safety, not because it's required by the spec.

For more information see: https://stackoverflow.com/questions/1580647/json-why-are-forward-slashes-escaped#1580682

from json-java.