Apache Commons

If you're already using Apache commons, it provides a static method for this:

StringEscapeUtils.escapeJson("some string")

It converts any string into one that's properly escaped for inclusion in JSON

See the documentation here

Extract From Jettison:

 public static String quote(String string) {
         if (string == null || string.length() == 0) {
             return "\"\"";
         }

         char         c = 0;
         int          i;
         int          len = string.length();
         StringBuilder sb = new StringBuilder(len + 4);
         String       t;

         sb.append('"');
         for (i = 0; i < len; i += 1) {
             c = string.charAt(i);
             switch (c) {
             case '\\':
             case '"':
                 sb.append('\\');
                 sb.append(c);
                 break;
             case '/':
 //                if (b == '<') {
                     sb.append('\\');
 //                }
                 sb.append(c);
                 break;
             case '\b':
                 sb.append("\\b");
                 break;
             case '\t':
                 sb.append("\\t");
                 break;
             case '\n':
                 sb.append("\\n");
                 break;
             case '\f':
                 sb.append("\\f");
                 break;
             case '\r':
                sb.append("\\r");
                break;
             default:
                 if (c < ' ') {
                     t = "000" + Integer.toHexString(c);
                     sb.append("\\u" + t.substring(t.length() - 4));
                 } else {
                     sb.append(c);
                 }
             }
         }
         sb.append('"');
         return sb.toString();
     }

Using Gson for serialization proved to be quite easy and bulletproof. Afterwards Apache's commons-lang3 = 3.1 escapeEcmaScript is used. In 3.2 there's also escapeJson method.

import com.google.api.client.json.GenericJson;
import com.google.api.client.util.Key;
import com.google.gson.Gson;
import org.apache.commons.lang3.StringEscapeUtils;

public class MyJson extends GenericJson {

    @Key("commands")
    public String commands;

    public String serialize() throws IOException {
      Gson gson = new Gson();
      String g = gson.toJson(this);
      return StringEscapeUtils.escapeEcmaScript(g);
    }
}

This produces escaped JSON:

{\"commands\":\"ls -laF\\ndu -h\"}

Deserialization is then quite simple:

protected MyJson deserialize(String str) throws IOException {
    String json = StringEscapeUtils.unescapeEcmaScript(str);
    JsonObjectParser parser = (new JacksonFactory()).createJsonObjectParser();
    return parser.parseAndClose(new StringReader(json), MyJson.class);
}

The escapeEcmaScript method isn't complicated, it does following replacement:

  {"'", "\\'"},
  {"\"", "\\\""},
  {"\\", "\\\\"},
  {"/", "\\/"}

But at least is something I don't have to care about.