JSONObject::quote(). Why special case for "</" but not "/"

[budric]

Hi,
I'm having trouble understanding this code:
case '/':
if (b == '<') {
sb.append('');
}
sb.append(c);
break;

Why is escape character '' only appended when the previous character is <. Looking at JSON control characters, the '/' is always a control character and should be prefixed with . Yet the code doesn't do that.

Thanks,

[douglascrockford]

There is no requirement to escape /, but it may be escaped. This is useful when embedding JSON in HTML.

[budric]

I thought the grammar: http://json.org/ required it to be escaped. It's in the same list and no different from \b, \t, , etc. I'm worried about parser interoperability between different platforms like Java generated JSON on C++...

[douglascrockford]

You are mistaken.

[Doogiemuc]

No he is right. JsonObject DOES quote forward slashes in JsonStringer.string(String value) method.

[johnjaylward]

@Doogiemuc the forward slash escape is technically optional in the JSON spec, which is what Douglas was talking about. The reason that this library escapes them is because embedding JSON directly into HTML can cause "remote code execution" issues when you don't escape them. We escape them by default for safety, not because it's required by the spec.

For more information see: https://stackoverflow.com/questions/1580647/json-why-are-forward-slashes-escaped#1580682