Guides

HTML entities inside JSON: escaping pitfalls in templates

Embedding HTML snippets, email templates, or rich-text placeholders in JSON—quotes, ampersands, newlines.

Why JSON breaks easily here

JSON strings use double quotes; inner `"` must be escaped as `\"` or parsing fails.

Smart quotes and raw newlines inside “HTML-ish” blobs also break strict JSON if pasted manually.

Entities vs JSON escaping

HTML entities (`&`, `<`) matter when emitting HTML documents.

Inside JSON you still need valid JSON string escaping first; XSS defenses belong at render time.

Workflow

Prefer `JSON.stringify` on fragments rather than hand-concatenating quotes.

Use format + escape/unescape tools to see whether corruption happened at JSON vs HTML layers.