Escape or unescape one JSON string safely

A JSON string is surrounded by double quotes. A quote, backslash, or control character inside the value must be represented with an escape sequence so it is not mistaken for syntax. Escape mode uses the browser's JSON serializer to produce one complete literal, including the outer quotes.

The transformation does not create an object member or request body by itself. Insert the literal at a location where a JSON value is expected, and validate the final document. Escaping the entire object text would turn the object into a string rather than embedding its members.

Unescape mode parses exactly one quoted JSON string. It rejects an unquoted fragment, a number, an object, an array, and malformed sequences such as an incomplete Unicode escape. The returned output is the decoded string value, which may contain real newlines or tabs.

No `eval`, Function constructor, template expansion, or HTML interpretation is involved. Decoded text is still untrusted data. Escape it again for the actual destination context before inserting it into HTML, SQL, shell commands, logs, or another programming language.

Confusing bugs appear when a JSON string is itself embedded in a JavaScript string, command line, YAML file, or environment variable. Each surrounding syntax has different quoting rules. Work from the innermost value outward and record which layer owns each backslash.

Prefer typed serializers and request libraries over manual concatenation. When diagnosing a double-escaped value, compare the raw bytes at each boundary and add a round-trip test proving that serialization followed by parsing restores the intended text.