That's not the reason why people escape quotes. Imagine the case where he had not escaped quotes, but had escaped < and >. In that case, I could put a doublequ

That's not the reason why people escape quotes. Imagine the case where he had not escaped quotes, but had escaped < and >. In that case, I could put a doublequote/singlequote to break out of the JSON. Then I could just put whatever javascript I wanted and run it. But that is true, trying to filter specific character sequences for example, "eval" is never a good idea.