diff --git a/api/src/org/labkey/api/assay/AssayProtocolSchema.java b/api/src/org/labkey/api/assay/AssayProtocolSchema.java
index 705b9ce143e..a2a466079a5 100644
--- a/api/src/org/labkey/api/assay/AssayProtocolSchema.java
+++ b/api/src/org/labkey/api/assay/AssayProtocolSchema.java
@@ -85,6 +85,7 @@
 import org.labkey.api.util.FileUtil;
 import org.labkey.api.util.HtmlString;
 import org.labkey.api.util.HtmlStringBuilder;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
 import org.labkey.api.util.StringExpressionFactory;
@@ -913,7 +914,7 @@ public HtmlString getFormattedHtml(RenderContext ctx)
 
             try
             {
-                Map<String, String> decodedVals = new ObjectMapper().readValue(val.toString(), Map.class);
+                Map<String, String> decodedVals = JsonUtil.DEFAULT_MAPPER.readValue(val.toString(), Map.class);
                 HtmlStringBuilder sb = HtmlStringBuilder.of(decodedVals.remove(ParticipantVisitResolverType.Serializer.STRING_VALUE_PROPERTY_NAME));
 
                 // Issue 21126 If lookup was pasted tsv, could still get a default list entry in properties list. Fix the redisplay
diff --git a/api/src/org/labkey/api/data/JsonPrettyPrintDisplayColumnFactory.java b/api/src/org/labkey/api/data/JsonPrettyPrintDisplayColumnFactory.java
index 09e2292ea4c..ffed06ad1c5 100644
--- a/api/src/org/labkey/api/data/JsonPrettyPrintDisplayColumnFactory.java
+++ b/api/src/org/labkey/api/data/JsonPrettyPrintDisplayColumnFactory.java
@@ -20,6 +20,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.jetbrains.annotations.NotNull;
 import org.labkey.api.util.HtmlString;
+import org.labkey.api.util.JsonUtil;
 
 import java.io.IOException;
 
@@ -51,7 +52,7 @@ public HtmlString getFormattedHtml(RenderContext ctx)
             if (null == value)
                 return HtmlString.EMPTY_STRING;
 
-            ObjectMapper mapper = new ObjectMapper();
+            ObjectMapper mapper = JsonUtil.createDefaultMapper();
             DefaultPrettyPrinter pp = new DefaultPrettyPrinter();
             pp.indentArraysWith(new DefaultIndenter());
 
diff --git a/api/src/org/labkey/api/data/JsonTest.java b/api/src/org/labkey/api/data/JsonTest.java
index d1e1378eb42..4bcfc6a099e 100644
--- a/api/src/org/labkey/api/data/JsonTest.java
+++ b/api/src/org/labkey/api/data/JsonTest.java
@@ -75,7 +75,7 @@ public void jacksonTest()
     {
         try
         {
-            ObjectMapper mapper = new ObjectMapper().setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);
+            ObjectMapper mapper = JsonUtil.createDefaultMapper().setVisibility(PropertyAccessor.ALL, JsonAutoDetect.Visibility.ANY);
             Customer roundTripC1 = mapper.readValue(mapper.writeValueAsString(c1), Customer.class);
             assertEquals(c1, roundTripC1);
             Customer roundTripC2 = mapper.readValue(mapper.writeValueAsString(c2), Customer.class);
diff --git a/api/src/org/labkey/api/exp/TemplateInfo.java b/api/src/org/labkey/api/exp/TemplateInfo.java
index bbde4e0c44b..884e3a473a0 100644
--- a/api/src/org/labkey/api/exp/TemplateInfo.java
+++ b/api/src/org/labkey/api/exp/TemplateInfo.java
@@ -20,6 +20,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.commons.lang3.StringUtils;
 import org.labkey.api.data.JdbcType;
+import org.labkey.api.util.JsonUtil;
 
 import java.io.IOException;
 import java.io.StringWriter;
@@ -73,7 +74,7 @@ public String toJSON()
         {
             StringWriter sw = new StringWriter();
             JsonGenerator jsonGen = new JsonFactory().createGenerator(sw);
-            jsonGen.setCodec(new ObjectMapper());
+            jsonGen.setCodec(JsonUtil.createDefaultMapper());
             jsonGen.writeObject(this);
             return sw.toString();
         }
@@ -90,8 +91,7 @@ public static TemplateInfo fromJson(String json)
 
         try
         {
-            ObjectMapper om = new ObjectMapper();
-            HashMap map = om.readValue(json, HashMap.class);
+            HashMap map = JsonUtil.DEFAULT_MAPPER.readValue(json, HashMap.class);
             Double createdModuleVersion = null;
             if (null != map.get("createdModuleVersion"))
                 createdModuleVersion = (Double) JdbcType.DOUBLE.convert(map.get("createdModuleVersion"));
diff --git a/api/src/org/labkey/api/exp/api/DomainKindDesign.java b/api/src/org/labkey/api/exp/api/DomainKindDesign.java
index 64b8d94a28b..64d304762a2 100644
--- a/api/src/org/labkey/api/exp/api/DomainKindDesign.java
+++ b/api/src/org/labkey/api/exp/api/DomainKindDesign.java
@@ -2,6 +2,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.labkey.api.gwt.client.model.GWTDomain;
+import org.labkey.api.util.JsonUtil;
 
 import java.util.Map;
 
@@ -23,8 +24,7 @@ public void setDomainDesign(GWTDomain domainDesign)
 
     public Map<String, Object> getOptions()
     {
-        ObjectMapper mapper = new ObjectMapper();
-        return mapper.convertValue(_options, Map.class);
+        return JsonUtil.DEFAULT_MAPPER.convertValue(_options, Map.class);
     }
 
     public void setOptions(T options)
diff --git a/api/src/org/labkey/api/exp/api/ExperimentJSONConverter.java b/api/src/org/labkey/api/exp/api/ExperimentJSONConverter.java
index d590bd05908..1882e8dab90 100644
--- a/api/src/org/labkey/api/exp/api/ExperimentJSONConverter.java
+++ b/api/src/org/labkey/api/exp/api/ExperimentJSONConverter.java
@@ -47,6 +47,7 @@
 import org.labkey.api.query.ValidationException;
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.ReadPermission;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.Pair;
 import org.labkey.api.util.URIUtil;
 
@@ -895,8 +896,7 @@ public static String getAliasJson(Map<String, String> importAliases, String curr
 
         try
         {
-            ObjectMapper mapper = new ObjectMapper();
-            return mapper.writeValueAsString(aliases);
+            return JsonUtil.DEFAULT_MAPPER.writeValueAsString(aliases);
         }
         catch (JsonProcessingException e)
         {
diff --git a/api/src/org/labkey/api/exp/property/DomainUtil.java b/api/src/org/labkey/api/exp/property/DomainUtil.java
index 486a85ace5f..a13b451ec2d 100644
--- a/api/src/org/labkey/api/exp/property/DomainUtil.java
+++ b/api/src/org/labkey/api/exp/property/DomainUtil.java
@@ -73,6 +73,7 @@
 import org.labkey.api.util.DateUtil;
 import org.labkey.api.util.GUID;
 import org.labkey.api.util.JdbcUtil;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.Pair;
 import org.labkey.api.util.StringExpression;
 import org.labkey.api.view.UnauthorizedException;
@@ -132,7 +133,7 @@ else if (AbstractAssayProvider.PARTICIPANT_VISIT_RESOLVER_PROPERTY_NAME.equalsIg
             // addition nested properties containing ThawList list settings.
             try
             {
-                Map<String, String> decodedVals = new ObjectMapper().readValue(defaultValue.toString(), Map.class);
+                Map<String, String> decodedVals = JsonUtil.DEFAULT_MAPPER.readValue(defaultValue.toString(), Map.class);
                 String stringValue = decodedVals.get("stringValue");
                 if (stringValue != null)
                     return stringValue;
@@ -640,10 +641,9 @@ public static Domain createDomain(
         {
             throw new ValidationException(ve);
         }
-        ObjectMapper mapper = new ObjectMapper();
 
         arguments = kind.processArguments(container, user, arguments);
-        Object options = mapper.convertValue(arguments, kind.getTypeClass());
+        Object options = JsonUtil.DEFAULT_MAPPER.convertValue(arguments, kind.getTypeClass());
         Domain created = kind.createDomain(domain, options, container, user, templateInfo);
 
         if (created == null)
diff --git a/api/src/org/labkey/api/files/view/filesWebPart.jsp b/api/src/org/labkey/api/files/view/filesWebPart.jsp
index a7149c0f218..b7ca9f94f53 100644
--- a/api/src/org/labkey/api/files/view/filesWebPart.jsp
+++ b/api/src/org/labkey/api/files/view/filesWebPart.jsp
@@ -77,7 +77,7 @@
 <div id="<%=h(bean.getContentId())%>"></div>
 <script type="text/javascript" nonce="<%=getScriptNonce()%>">
     Ext4.onReady(function() {
-        var buttonActions = [<% String sep = ""; for(FilesWebPart.FilesForm.actions action  : bean.getButtonConfig()) {%><%=text(sep)%>'<%=text(action.name())%>'<% sep = ","; }%>];
+        var buttonActions = [<% String sep = ""; for(FilesWebPart.FilesForm.actions action  : bean.getButtonConfig()) {%><%=text(sep)%><%=q(action.name())%><% sep = ","; }%>];
         var startDirectory;
 
         <% if (bean.getDirectory() != null) { %>
diff --git a/api/src/org/labkey/api/jsp/JspBase.java b/api/src/org/labkey/api/jsp/JspBase.java
index 3cc159070ce..6f9b3522af2 100644
--- a/api/src/org/labkey/api/jsp/JspBase.java
+++ b/api/src/org/labkey/api/jsp/JspBase.java
@@ -262,12 +262,12 @@ public static JavaScriptFragment json(JSONObject jsonObject, int indentFactor)
      */
     final protected JavaScriptFragment q(String str)
     {
-        return null == str ? JavaScriptFragment.NULL : JavaScriptFragment.unsafe(PageFlowUtil.jsString(str));
+        return JavaScriptFragment.asString(str);
     }
 
     final protected JavaScriptFragment q(HtmlString hs)
     {
-        return null == hs ? JavaScriptFragment.NULL : JavaScriptFragment.unsafe(PageFlowUtil.jsString(hs.toString()));
+        return null == hs ? JavaScriptFragment.NULL : JavaScriptFragment.asString(hs.toString());
     }
 
     /**
@@ -282,7 +282,7 @@ final protected JavaScriptFragment q(@Nullable URLHelper url)
 
     final protected JavaScriptFragment q(SafeToRender str)
     {
-        return null == str ? JavaScriptFragment.NULL : JavaScriptFragment.unsafe(PageFlowUtil.jsString(str.toString()));
+        return null == str ? JavaScriptFragment.NULL : JavaScriptFragment.asString(str.toString());
     }
 
     protected HtmlString hq(String str)
diff --git a/api/src/org/labkey/api/query/import.jsp b/api/src/org/labkey/api/query/import.jsp
index 4fe7c7d4ac2..05574c0fdf1 100644
--- a/api/src/org/labkey/api/query/import.jsp
+++ b/api/src/org/labkey/api/query/import.jsp
@@ -25,6 +25,7 @@
 <%@ page import="org.labkey.api.view.HttpView" %>
 <%@ page import="org.labkey.api.view.template.ClientDependencies" %>
 <%@ page import="static org.labkey.api.util.HtmlString.NDASH" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase"%>
 <%!
     @Override
@@ -482,7 +483,7 @@
             timeout: Ext4.Ajax.timeout,
 
             items: getImportOptions(1).concat([
-                <%=unsafe(extraFormFields)%>
+                <%=JavaScriptFragment.unsafe(extraFormFields)%>
                 {
                     xtype: 'hidden', name: 'X-LABKEY-CSRF', value: LABKEY.CSRF
                 },
@@ -557,7 +558,7 @@
             timeout: Ext4.Ajax.timeout,
 
             items: getImportOptions(0).concat([
-                    <%=unsafe(extraFormFields)%>
+                    <%=JavaScriptFragment.unsafe(extraFormFields)%>
                     {
                         xtype: 'hidden', name: 'X-LABKEY-CSRF', value: LABKEY.CSRF
                     },
diff --git a/api/src/org/labkey/api/reader/JSONDataLoader.java b/api/src/org/labkey/api/reader/JSONDataLoader.java
index 400b079ae2d..31fbb19b141 100644
--- a/api/src/org/labkey/api/reader/JSONDataLoader.java
+++ b/api/src/org/labkey/api/reader/JSONDataLoader.java
@@ -251,10 +251,8 @@ private JSONDataLoader(JsonParser parser)
 
     protected void init(InputStream is) throws IOException
     {
-        // TODO: JsonFactory is threadsafe and can be configured once and shared across the application.
-        JsonFactory factory = new JsonFactory();
-        _mapper = new ObjectMapper(factory);
-        _parser = factory.createParser(is);
+        _mapper = JsonUtil.createDefaultMapper();
+        _parser = _mapper.getFactory().createParser(is);
         enterTopLevel();
     }
 
@@ -936,8 +934,8 @@ public abstract static class JsonBaseTest extends Assert
     {
         JsonParser createParser(String json) throws IOException
         {
-            ObjectMapper mapper = new ObjectMapper();
-            JsonFactory factory = new JsonFactory(mapper);
+            ObjectMapper mapper = JsonUtil.createDefaultMapper();
+            JsonFactory factory = mapper.getFactory();
             JsonParser parser = factory.createParser(json);
             parser.nextToken();
             return parser;
diff --git a/api/src/org/labkey/api/reports/report/view/ajaxScriptReportDesigner.jsp b/api/src/org/labkey/api/reports/report/view/ajaxScriptReportDesigner.jsp
index 4fc0ca4f802..f623c9449b1 100644
--- a/api/src/org/labkey/api/reports/report/view/ajaxScriptReportDesigner.jsp
+++ b/api/src/org/labkey/api/reports/report/view/ajaxScriptReportDesigner.jsp
@@ -48,7 +48,7 @@
 <%@ page import="java.util.ListIterator" %>
 <%@ page import="java.util.Map" %>
 <%@ page import="org.labkey.api.reports.report.python.IpynbReport" %>
-<%@ page import="org.labkey.api.util.JsonUtil" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 <%!
@@ -198,8 +198,8 @@
                 preferSourceTab : <%=mode.preferSourceTab()%>,
                 sourceAndHelp   : <%=sourceAndHelp%>,
                 redirectUrl     : <%=q(bean.getRedirectUrl())%>,
-                sharedScripts   : <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(sharedScripts))%>,
-                reportConfig    : <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(reportConfig))%>,
+                sharedScripts   : <%=JavaScriptFragment.asJson(sharedScripts)%>,
+                reportConfig    : <%=JavaScriptFragment.asJson(reportConfig)%>,
                 script          : <%=q(StringUtils.trimToEmpty(bean.getScript()))%>,
                 htmlEncodedProps: true
             });
diff --git a/api/src/org/labkey/api/reports/report/view/javaScriptReport.jsp b/api/src/org/labkey/api/reports/report/view/javaScriptReport.jsp
index 13c63eab926..2f0fbea9ce9 100644
--- a/api/src/org/labkey/api/reports/report/view/javaScriptReport.jsp
+++ b/api/src/org/labkey/api/reports/report/view/javaScriptReport.jsp
@@ -17,6 +17,7 @@
 %>
 <%@ page import="org.labkey.api.reports.report.JavaScriptReport.JavaScriptReportBean" %>
 <%@ page import="org.labkey.api.util.UniqueID" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%
     JavaScriptReportBean bean = (JavaScriptReportBean)getModelBean();
@@ -28,7 +29,7 @@
     (function()
     {
         // ========== Begin report writer's script ==========
-        <%=text(bean.script)%>
+        <%=JavaScriptFragment.unsafe(bean.script)%>
         // ========== End report writer's script ==========
         if (render && (typeof render === 'function'))
         {
@@ -68,15 +69,15 @@
             }
 
             %>
-            render(getDataConfig, document.getElementById("<%=text(uniqueDivName)%>"));
+            render(getDataConfig, document.getElementById(<%=q(uniqueDivName)%>));
             <%
                 }
                 else
                 {
             %>
             render({
-                <%=text(bean.model.getStandardJavaScriptParameters(16, false))%>
-            }, document.getElementById("<%=text(uniqueDivName)%>"));
+                <%=JavaScriptFragment.unsafe(bean.model.getStandardJavaScriptParameters(16, false))%>
+            }, document.getElementById(<%=q(uniqueDivName)%>));
             <%
                 }
             %>
diff --git a/api/src/org/labkey/api/study/assay/ParticipantVisitResolverType.java b/api/src/org/labkey/api/study/assay/ParticipantVisitResolverType.java
index 5c491d429e7..31d150c6abb 100644
--- a/api/src/org/labkey/api/study/assay/ParticipantVisitResolverType.java
+++ b/api/src/org/labkey/api/study/assay/ParticipantVisitResolverType.java
@@ -28,6 +28,7 @@
 import org.labkey.api.exp.api.ExpMaterial;
 import org.labkey.api.exp.api.ExpRun;
 import org.labkey.api.security.User;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.UnexpectedException;
 import org.labkey.api.view.InsertView;
 
@@ -79,7 +80,7 @@ public static void decode(String stringValue, Map<String, Object> formDefaults,
         {
             try
             {
-                Map<String, String> decodedVals = new ObjectMapper().readValue(stringValue, Map.class);
+                Map<String, String> decodedVals = JsonUtil.DEFAULT_MAPPER.readValue(stringValue, Map.class);
                 formDefaults.put(propName, decodedVals.remove(STRING_VALUE_PROPERTY_NAME));
                 formDefaults.putAll(decodedVals);
             }
@@ -106,7 +107,7 @@ public static String encode(String resolverType, HttpServletRequest request)
             try
             {
                 // Prevent double encoding; if the resolverType string is already a json map, return it.
-                new ObjectMapper().readValue(resolverType, Map.class);
+                JsonUtil.DEFAULT_MAPPER.readValue(resolverType, Map.class);
                 return resolverType;
             }
             catch (IOException e)
@@ -140,7 +141,7 @@ public static String encode(String resolverType, HttpServletRequest request)
 
             try
             {
-                return new ObjectMapper().writeValueAsString(jsonValues);
+                return JsonUtil.DEFAULT_MAPPER.writeValueAsString(jsonValues);
             }
             catch (JsonProcessingException e)
             {
diff --git a/api/src/org/labkey/api/study/assay/thawListSelector.jsp b/api/src/org/labkey/api/study/assay/thawListSelector.jsp
index 63d68b82885..33ffb8b17a4 100644
--- a/api/src/org/labkey/api/study/assay/thawListSelector.jsp
+++ b/api/src/org/labkey/api/study/assay/thawListSelector.jsp
@@ -80,7 +80,7 @@
         var sqvModel = Ext4.create('LABKEY.sqv.Model', {});
 
         var sourceContainerCombo = Ext4.create('Ext.form.field.ComboBox', sqvModel.makeContainerComboConfig({
-            name: '<%= text(ThawListResolverType.THAW_LIST_LIST_CONTAINER_INPUT_NAME) %>',
+            name: <%= q(ThawListResolverType.THAW_LIST_LIST_CONTAINER_INPUT_NAME) %>,
             id : 'thawListContainer',
             fieldLabel: 'Folder',
             value: <%=(container == null ? JavaScriptFragment.NULL : q(container.getPath())) %>,
@@ -97,7 +97,7 @@
             forceSelection : true,
             initialValue : <%=q(ctx.getForm().get(ThawListResolverType.THAW_LIST_LIST_SCHEMA_NAME_INPUT_NAME))%>,
             fieldLabel : 'Schema',
-            name: '<%= text(ThawListResolverType.THAW_LIST_LIST_SCHEMA_NAME_INPUT_NAME) %>',
+            name: <%= q(ThawListResolverType.THAW_LIST_LIST_SCHEMA_NAME_INPUT_NAME) %>,
             validateOnBlur: false,
             width: 500
         }));
@@ -109,7 +109,7 @@
             typeAhead : true,
             typeAheadDelay : 250,
             fieldLabel : 'Query',
-            name: '<%= text(ThawListResolverType.THAW_LIST_LIST_QUERY_NAME_INPUT_NAME) %>',
+            name: <%= q(ThawListResolverType.THAW_LIST_LIST_QUERY_NAME_INPUT_NAME) %>,
             initialValue : <%=q(ctx.getForm().get(ThawListResolverType.THAW_LIST_LIST_QUERY_NAME_INPUT_NAME))%>,
             width: 500
         }));
@@ -129,7 +129,7 @@
     addParticipantVisitResolverSelectionChangeListener(function()
     {
         handleAllowedDefaultOptionsForThawList();
-        if (document.getElementById('<%=text(listTypeId)%>').checked)
+        if (document.getElementById(<%=q(listTypeId)%>).checked)
             showChooseList();
         else
             thawListQueryPickerPanel.doLayout();
@@ -147,7 +147,7 @@
 
         if (document.getElementById('RadioBtn-Lookup').checked)
         {
-            var textRadio = Ext4.get('<%=text(textTypeId)%>');
+            var textRadio = Ext4.get(<%=q(textTypeId)%>);
             if ((textRadio && textRadio.dom.checked) || <%=textType%>)
                 toggleDisableResetDefault(true); // Don't allow trying to set the default to the text type, as this is not supported.
         }
@@ -172,7 +172,7 @@
     { %>
     // Allow tabs in the TSV text area
         <labkey:loadClientDependencies>
-            Ext.EventManager.on('<%= text(ThawListResolverType.THAW_LIST_TEXT_AREA_INPUT_NAME) %>', 'keydown', LABKEY.ext.Utils.handleTabsInTextArea);
+            Ext.EventManager.on(<%= q(ThawListResolverType.THAW_LIST_TEXT_AREA_INPUT_NAME) %>, 'keydown', LABKEY.ext.Utils.handleTabsInTextArea);
         </labkey:loadClientDependencies>
     <% } %>
 </script>
diff --git a/api/src/org/labkey/api/util/JavaScriptFragment.java b/api/src/org/labkey/api/util/JavaScriptFragment.java
index da9a5413d1a..2037f43455f 100644
--- a/api/src/org/labkey/api/util/JavaScriptFragment.java
+++ b/api/src/org/labkey/api/util/JavaScriptFragment.java
@@ -1,5 +1,7 @@
 package org.labkey.api.util;
 
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.apache.commons.lang3.StringUtils;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 
@@ -9,6 +11,7 @@
  */
 public class JavaScriptFragment implements SafeToRender
 {
+    public static final JavaScriptFragment EMPTY = new JavaScriptFragment("");
     public static final JavaScriptFragment EMPTY_STRING = JavaScriptFragment.unsafe("''");
     public static final JavaScriptFragment NULL = JavaScriptFragment.unsafe(" null ");
     public static final JavaScriptFragment TRUE = JavaScriptFragment.unsafe(" true ");
@@ -25,9 +28,42 @@ public class JavaScriptFragment implements SafeToRender
      */
     public static @NotNull JavaScriptFragment unsafe(@Nullable String s)
     {
+        if (null == s)
+            return EMPTY;
+        // even with unsafe() a javascript fragment can never contain the sequence "</[Ss][Cc][Rr][Ii][Pp][Tt]>"
+        // since </ is not legal javascript syntax we escape it
+        s = StringUtils.replace(s, "</", "<\\/");
         return new JavaScriptFragment(s);
     }
 
+    /** Create escaped javascript string literal */
+    public static @NotNull JavaScriptFragment asString(String s)
+    {
+        if (null == s)
+            return JavaScriptFragment.NULL;
+        var js = PageFlowUtil.jsString(s);
+        assert !StringUtils.contains(js, "</");
+        return new JavaScriptFragment(js);
+    }
+
+    /** Format "Object value" as JSON and render into a JavaScriptFragment */
+    public static @NotNull JavaScriptFragment asJson(Object value)
+    {
+        if (null == value)
+            return NULL;
+        try
+        {
+            String s = JsonUtil.DEFAULT_MAPPER.writeValueAsString(value);
+            if (StringUtils.contains(s, "</"))
+                throw new IllegalStateException("Error encoding JSON object");
+            return new JavaScriptFragment(s);
+        }
+        catch (JsonProcessingException x)
+        {
+            throw UnexpectedException.wrap(x);
+        }
+    }
+
     // Callers use factory method unsafe() instead
     private JavaScriptFragment(String s)
     {
diff --git a/api/src/org/labkey/api/util/MothershipReport.java b/api/src/org/labkey/api/util/MothershipReport.java
index 1ee676f7d61..5113f5a169b 100644
--- a/api/src/org/labkey/api/util/MothershipReport.java
+++ b/api/src/org/labkey/api/util/MothershipReport.java
@@ -512,10 +512,9 @@ public void setMetrics(Map<String, Object> metrics)
         if (metrics.size() > 0)
         {
             String serializedMetrics;
-            ObjectMapper mapper = new ObjectMapper();
             try
             {
-                serializedMetrics = mapper.writeValueAsString(metrics);
+                serializedMetrics = JsonUtil.DEFAULT_MAPPER.writeValueAsString(metrics);
                 addParam(JSON_METRICS_KEY, serializedMetrics);
             }
             catch (JsonProcessingException e)
diff --git a/api/src/org/labkey/api/util/SafeToRenderBuilder.java b/api/src/org/labkey/api/util/SafeToRenderBuilder.java
index 7554f0aa30a..8574790f438 100644
--- a/api/src/org/labkey/api/util/SafeToRenderBuilder.java
+++ b/api/src/org/labkey/api/util/SafeToRenderBuilder.java
@@ -32,7 +32,7 @@ public int length()
 
     public SafeToRender getSafeToRender()
     {
-        return JavaScriptFragment.unsafe(_sb.toString());
+        return HtmlString.unsafe(_sb.toString());
     }
 
     @Override
diff --git a/api/src/org/labkey/api/util/UsageReportingLevel.java b/api/src/org/labkey/api/util/UsageReportingLevel.java
index 574ec1f6682..b993968a509 100644
--- a/api/src/org/labkey/api/util/UsageReportingLevel.java
+++ b/api/src/org/labkey/api/util/UsageReportingLevel.java
@@ -334,7 +334,7 @@ public static Map<String, Object> getMetrics(UsageReportingLevel level)
             try
             {
                 @SuppressWarnings({"unchecked"})
-                Map<String, Object> metrics = new ObjectMapper().readValue(Objects.requireNonNull(getReportParams(level)).get("jsonMetrics"), Map.class);
+                Map<String, Object> metrics = JsonUtil.DEFAULT_MAPPER.readValue(Objects.requireNonNull(getReportParams(level)).get("jsonMetrics"), Map.class);
                 return metrics;
             }
             catch (IOException e)
diff --git a/assay/src/org/labkey/assay/plate/AssayPlateMetadataServiceImpl.java b/assay/src/org/labkey/assay/plate/AssayPlateMetadataServiceImpl.java
index 7b118ec8156..998e06e812d 100644
--- a/assay/src/org/labkey/assay/plate/AssayPlateMetadataServiceImpl.java
+++ b/assay/src/org/labkey/assay/plate/AssayPlateMetadataServiceImpl.java
@@ -44,6 +44,7 @@
 import org.labkey.api.query.QueryUpdateService;
 import org.labkey.api.query.ValidationException;
 import org.labkey.api.security.User;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.assay.TSVProtocolSchema;
 import org.labkey.assay.plate.model.Well;
 import org.labkey.assay.query.AssayDbSchema;
@@ -412,11 +413,10 @@ public Map<String, MetadataLayer> parsePlateMetadata(JSONObject json) throws Exp
     {
         try
         {
-            ObjectMapper mapper = new ObjectMapper();
             if (json == null)
                 throw new ExperimentException("No plate metadata was uploaded");
 
-            return _parsePlateMetadata(mapper.readTree(json.toString()));
+            return _parsePlateMetadata(JsonUtil.DEFAULT_MAPPER.readTree(json.toString()));
         }
         catch (Exception e)
         {
@@ -429,11 +429,10 @@ public Map<String, MetadataLayer> parsePlateMetadata(File jsonData) throws Exper
     {
         try
         {
-            ObjectMapper mapper = new ObjectMapper();
             if (jsonData == null)
                 throw new ExperimentException("No plate metadata was uploaded");
 
-            return _parsePlateMetadata(mapper.readTree(jsonData));
+            return _parsePlateMetadata(JsonUtil.DEFAULT_MAPPER.readTree(jsonData));
         }
         catch (Exception e)
         {
diff --git a/core/src/org/labkey/core/admin/createFolder.jsp b/core/src/org/labkey/core/admin/createFolder.jsp
index 15ad921d2c6..2b7465e023f 100644
--- a/core/src/org/labkey/core/admin/createFolder.jsp
+++ b/core/src/org/labkey/core/admin/createFolder.jsp
@@ -24,6 +24,7 @@
 <%@ page import="org.labkey.core.admin.AdminController" %>
 <%@ page import="org.labkey.core.portal.CollaborationFolderType" %>
 <%@ page import="org.labkey.core.portal.ProjectController" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%!
     @Override
@@ -82,7 +83,7 @@
         var moduleTypesMap = {};
         var templateFolders = [];
         var selectedModules = <%=modulesOut%>;
-        var hasLoaded = <%=text(form.getHasLoaded()?"true":"false")%>;
+        var hasLoaded = <%=JavaScriptFragment.bool(form.getHasLoaded())%>;
         var defaultTab = <%=q(form.getDefaultModule())%>;
         var selectedTemplateFolder = <%=q(form.getTemplateSourceId())%>;
         var selectedTemplateWriters = <%=templateWriterTypes%>;
diff --git a/core/src/org/labkey/core/admin/folderType.jsp b/core/src/org/labkey/core/admin/folderType.jsp
index dd05419a36f..1833180dda1 100644
--- a/core/src/org/labkey/core/admin/folderType.jsp
+++ b/core/src/org/labkey/core/admin/folderType.jsp
@@ -347,7 +347,7 @@ for (Module module : allModules)
         LABKEY.requiresExt4Sandbox(function() {
             Ext4.onReady(function() {
                 Ext4.create('Ext.button.Button', {
-                    text: '<%=text(form.isWizard() ? "Next" : "Update Folder")%>',
+                    text: <%=q(form.isWizard() ? "Next" : "Update Folder")%>,
                     renderTo: 'UpdateFolderButtonDiv',
                     handler: function() {
                         if (!validate()) {
@@ -380,7 +380,7 @@ for (Module module : allModules)
                             url: LABKEY.ActionURL.buildURL('core', 'getContainerInfo.api'),
                             method: 'POST',
                             jsonData: {
-                                containerPath: "<%=text(path)%>",
+                                containerPath: <%=q(path)%>,
                                 newFolderType: newFolderType
                             },
                             success: function (resp) {
diff --git a/core/src/org/labkey/core/admin/moveFolder.jsp b/core/src/org/labkey/core/admin/moveFolder.jsp
index 7a99219d907..f0b95ba2c65 100644
--- a/core/src/org/labkey/core/admin/moveFolder.jsp
+++ b/core/src/org/labkey/core/admin/moveFolder.jsp
@@ -26,6 +26,7 @@
 <%@ page import="org.labkey.core.admin.AdminController.MoveFolderTreeView" %>
 <%@ page import="org.springframework.validation.Errors" %>
 <%@ page import="org.springframework.validation.ObjectError" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%!
     @Override
@@ -113,7 +114,7 @@
                 editable : true,
                 expandable : true,
                 text : <%=q(project.getParent().getName())%>,
-                <%=text(project.equals(c) ? "cls : 'x-tree-node-current'" : "")%>
+                <%=JavaScriptFragment.unsafe(project.equals(c) ? "cls : 'x-tree-node-current'" : "")%>
             }),
             rootVisible: false,
             enableDrag: false,
diff --git a/core/src/org/labkey/core/view/configReportsAndScripts.jsp b/core/src/org/labkey/core/view/configReportsAndScripts.jsp
index 2b32a6ebc0d..9730962dbe9 100644
--- a/core/src/org/labkey/core/view/configReportsAndScripts.jsp
+++ b/core/src/org/labkey/core/view/configReportsAndScripts.jsp
@@ -817,7 +817,7 @@
                         var record = {
                             name: R_ENGINE_NAME,
                             extensions: R_EXTENSIONS,
-                            exeCommand: '<%=text(RReport.DEFAULT_R_CMD)%>',
+                            exeCommand: <%=q(RReport.DEFAULT_R_CMD)%>,
                             <% if (!StringUtils.isEmpty(RReport.getDefaultRPath())) { %>
                             exePath: <%=q(RReport.getDefaultRPath())%>,
                             <% } %>
@@ -851,9 +851,9 @@
                             var record = {
                                 name: REMOTE_R_ENGINE_NAME,
                                 extensions: R_EXTENSIONS,
-                                machine: '<%=text(RReport.DEFAULT_R_MACHINE)%>',
+                                machine: <%=q(RReport.DEFAULT_R_MACHINE)%>,
                                 port:<%=RReport.DEFAULT_R_PORT%>,
-                                exeCommand: '<%=text(RReport.DEFAULT_RSERVE_CMD)%>',
+                                exeCommand: <%=q(RReport.DEFAULT_RSERVE_CMD)%>,
                                 outputFileName: <%= q(ExternalScriptEngine.SCRIPT_NAME_REPLACEMENT + ".Rout") %>,
                                 'default': !defaultR,
                                 external: true,
diff --git a/core/src/org/labkey/core/webdav/davListing.jsp b/core/src/org/labkey/core/webdav/davListing.jsp
index 85c31bf3286..ca2733a7b1d 100644
--- a/core/src/org/labkey/core/webdav/davListing.jsp
+++ b/core/src/org/labkey/core/webdav/davListing.jsp
@@ -23,6 +23,7 @@
 <%@ page import="org.labkey.core.webdav.DavController" %>
 <%@ page import="org.labkey.api.premium.PremiumService" %>
 <%@ page import="org.apache.commons.lang3.StringUtils" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%!
     @Override
@@ -102,7 +103,7 @@
                 actions: [
                     'folderTreeToggle', 'parentFolder', 'refresh',
                     'createDirectory', 'download', 'deletePath', 'renamePath', 'movePath', 'upload',
-                    '->', htmlViewAction, <%=unsafe(getUser().isGuest() ? "loginAction" : "logoutAction")%>
+                    '->', htmlViewAction, <%=JavaScriptFragment.unsafe(getUser().isGuest() ? "loginAction" : "logoutAction")%>
                 ],
                 useServerActions: false
             }],
diff --git a/experiment/src/org/labkey/experiment/ConfirmDelete.jsp b/experiment/src/org/labkey/experiment/ConfirmDelete.jsp
index 39a951093b2..4f0aaa2b8e4 100644
--- a/experiment/src/org/labkey/experiment/ConfirmDelete.jsp
+++ b/experiment/src/org/labkey/experiment/ConfirmDelete.jsp
@@ -73,7 +73,7 @@
 <% if (bean.getObjects().isEmpty())
 {
     %><p>There are no <%= h(numReferencedItems > 0 ? " additional " : "")%>selected objects to delete.</p>
-    <%= text(button("OK").href(successUrl).toString())%><%
+    <%= button("OK").href(successUrl) %><%
 }
 else
 { %>
@@ -217,6 +217,6 @@ else
         { %>
             <%= button("Confirm Delete").submit(true).disableOnClick(true) %>
         <% } %>
-        <%= text(button("Cancel").href(cancelUrl).toString())%>
+        <%= button("Cancel").href(cancelUrl) %>
     </labkey:form>
 <% } %>
diff --git a/experiment/src/org/labkey/experiment/api/ExpDataClassImpl.java b/experiment/src/org/labkey/experiment/api/ExpDataClassImpl.java
index b4f6e548a29..93416ab5ea4 100644
--- a/experiment/src/org/labkey/experiment/api/ExpDataClassImpl.java
+++ b/experiment/src/org/labkey/experiment/api/ExpDataClassImpl.java
@@ -51,6 +51,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.DataClassReadPermission;
 import org.labkey.api.security.permissions.MediaReadPermission;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
 import org.labkey.api.util.UnexpectedException;
@@ -321,6 +322,8 @@ public void delete(User user, @Nullable String auditUserComment)
     public TableInfo getTinfo()
     {
         Domain d = getDomain();
+        if (null == d)
+            throw new NullPointerException("domain is null");
         return StorageProvisioner.createTableInfo(d);
     }
 
@@ -505,10 +508,9 @@ public void ensureMinGenId(long newSeqValue, Container c) throws ExperimentExcep
 
         try
         {
-            ObjectMapper mapper = new ObjectMapper();
             TypeReference<CaseInsensitiveHashMap<String>> typeRef = new TypeReference<>() {};
 
-            return mapper.readValue(ds.getDataParentImportAliasMap(), typeRef);
+            return JsonUtil.DEFAULT_MAPPER.readValue(ds.getDataParentImportAliasMap(), typeRef);
         }
         catch (IOException e)
         {
diff --git a/experiment/src/org/labkey/experiment/api/ExpSampleTypeImpl.java b/experiment/src/org/labkey/experiment/api/ExpSampleTypeImpl.java
index 1af6c1dd16f..050b080d429 100644
--- a/experiment/src/org/labkey/experiment/api/ExpSampleTypeImpl.java
+++ b/experiment/src/org/labkey/experiment/api/ExpSampleTypeImpl.java
@@ -64,6 +64,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.security.permissions.MediaReadPermission;
 import org.labkey.api.study.StudyService;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Path;
 import org.labkey.api.util.StringExpressionFactory;
@@ -1005,10 +1006,9 @@ public String getDocumentId()
 
         try
         {
-            ObjectMapper mapper = new ObjectMapper();
             TypeReference<CaseInsensitiveHashMap<String>> typeRef = new TypeReference<>() {};
 
-            return mapper.readValue(ms.getMaterialParentImportAliasMap(), typeRef);
+            return JsonUtil.DEFAULT_MAPPER.readValue(ms.getMaterialParentImportAliasMap(), typeRef);
         }
         catch (IOException e)
         {
diff --git a/experiment/src/org/labkey/experiment/api/ImportAliasesDisplayColumnFactory.java b/experiment/src/org/labkey/experiment/api/ImportAliasesDisplayColumnFactory.java
index 7cd9d2e4951..27c82a6b852 100644
--- a/experiment/src/org/labkey/experiment/api/ImportAliasesDisplayColumnFactory.java
+++ b/experiment/src/org/labkey/experiment/api/ImportAliasesDisplayColumnFactory.java
@@ -14,6 +14,7 @@
 import org.labkey.api.exp.api.ExpSampleType;
 import org.labkey.api.exp.api.SampleTypeService;
 import org.labkey.api.util.HtmlString;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.PageFlowUtil;
 
 import java.io.IOException;
@@ -107,12 +108,11 @@ public HtmlString getFormattedHtml(RenderContext ctx)
                     if (null == value)
                         return HtmlString.EMPTY_STRING;
 
-                    ObjectMapper mapper = new ObjectMapper();
                     DefaultPrettyPrinter pp = new DefaultPrettyPrinter();
                     pp.indentArraysWith(new DefaultIndenter());
 
-                    Object json = mapper.readValue(value.toString(), Object.class);
-                    String strValue = mapper.writer(pp).writeValueAsString(json);
+                    Object json = JsonUtil.DEFAULT_MAPPER.readValue(value.toString(), Object.class);
+                    String strValue = JsonUtil.DEFAULT_MAPPER.writer(pp).writeValueAsString(json);
                     String filteredValue = PageFlowUtil.filter(strValue, true);
                     return HtmlString.unsafe("<div>" + filteredValue + "</div>");
                 }
diff --git a/experiment/src/org/labkey/experiment/controllers/property/PropertyController.java b/experiment/src/org/labkey/experiment/controllers/property/PropertyController.java
index 8566fe475fd..9c5b3717153 100644
--- a/experiment/src/org/labkey/experiment/controllers/property/PropertyController.java
+++ b/experiment/src/org/labkey/experiment/controllers/property/PropertyController.java
@@ -90,6 +90,7 @@
 import org.labkey.api.util.ExceptionUtil;
 import org.labkey.api.util.FileType;
 import org.labkey.api.util.FileUtil;
+import org.labkey.api.util.JavaScriptFragment;
 import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.JunitUtil;
 import org.labkey.api.util.Pair;
@@ -1550,7 +1551,7 @@ private static GWTDomain getDomain(String schemaName, String queryName, Integer
 
     private static Map<String, Object> convertDomainToApiResponse(@NotNull GWTDomain domain)
     {
-        ObjectMapper om = new ObjectMapper();
+        ObjectMapper om = JsonUtil.createDefaultMapper();
         _propertyService.configureObjectMapper(om, null);
         try
         {
@@ -1562,13 +1563,13 @@ private static Map<String, Object> convertDomainToApiResponse(@NotNull GWTDomain
         }
     }
 
-    public static String convertDomainToJson(@NotNull GWTDomain domain)
+    public static JavaScriptFragment convertDomainToJson(@NotNull GWTDomain domain)
     {
-        ObjectMapper om = new ObjectMapper();
+        ObjectMapper om = JsonUtil.createDefaultMapper();
         _propertyService.configureObjectMapper(om, null);
         try
         {
-            return om.writeValueAsString(domain);
+            return JavaScriptFragment.unsafe(om.writeValueAsString(domain));
         }
         catch (Exception e)
         {
diff --git a/experiment/src/org/labkey/experiment/controllers/property/templateUpdate.jsp b/experiment/src/org/labkey/experiment/controllers/property/templateUpdate.jsp
index f0a5f7c22b3..c4b2fce351f 100644
--- a/experiment/src/org/labkey/experiment/controllers/property/templateUpdate.jsp
+++ b/experiment/src/org/labkey/experiment/controllers/property/templateUpdate.jsp
@@ -18,6 +18,7 @@
 <%@ page import="org.labkey.api.view.HttpView" %>
 <%@ page import="org.labkey.api.view.template.ClientDependencies" %>
 <%@ page import="org.labkey.experiment.controllers.property.PropertyController" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%!
     @Override
@@ -55,10 +56,10 @@
 {
     var schemaName = <%=  q(model.schemaName) %>;
     var queryName = <%=  q(model.queryName) %>;
-    var domain = <%= text(PropertyController.convertDomainToJson(model.domain)) %>;
+    var domain = <%= PropertyController.convertDomainToJson(model.domain) %>;
     domain.schemaName = schemaName;
     domain.queryName = queryName;
-    var template = <%= text(null==model.template ? "null" : PropertyController.convertDomainToJson(model.template)) %>;
+    var template = <%= null==model.template ? JavaScriptFragment.NULL : PropertyController.convertDomainToJson(model.template) %>;
     <% if (null == model.info) { %>
     var templateInfo = null;
     <% } else { %>
diff --git a/mothership/src/org/labkey/mothership/MothershipController.java b/mothership/src/org/labkey/mothership/MothershipController.java
index 601fa860d61..c1ce0a2b3b5 100644
--- a/mothership/src/org/labkey/mothership/MothershipController.java
+++ b/mothership/src/org/labkey/mothership/MothershipController.java
@@ -73,6 +73,7 @@
 import org.labkey.api.util.DateUtil;
 import org.labkey.api.util.GUID;
 import org.labkey.api.util.HtmlString;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.MothershipReport;
 import org.labkey.api.util.Pair;
 import org.labkey.api.util.URLHelper;
@@ -1211,8 +1212,7 @@ public Pair<ServerSession, SoftwareRelease> toSession(Container container)
                 try
                 {
                     // Capture the Core module's info to put into mothership.SoftwareRelease
-                    ObjectMapper mapper = new ObjectMapper();
-                    Map<String, Object> parsed = mapper.readValue(getJsonMetrics(), Map.class);
+                    Map<String, Object> parsed = JsonUtil.DEFAULT_MAPPER.readValue(getJsonMetrics(), Map.class);
                     Object modulesObject = parsed.get("modules");
                     if (modulesObject instanceof Map modulesMap)
                     {
diff --git a/mothership/src/org/labkey/mothership/MothershipManager.java b/mothership/src/org/labkey/mothership/MothershipManager.java
index f6544c06c41..694253d5716 100644
--- a/mothership/src/org/labkey/mothership/MothershipManager.java
+++ b/mothership/src/org/labkey/mothership/MothershipManager.java
@@ -37,6 +37,7 @@
 import org.labkey.api.security.User;
 import org.labkey.api.util.DateUtil;
 import org.labkey.api.util.GUID;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.MothershipReport;
 import org.labkey.api.util.ReentrantLockWithName;
 import org.labkey.api.util.logging.LogHelper;
@@ -377,7 +378,7 @@ private String getBestJson(String currentValue, String newValue, String serverSe
             // Verify the newValue as valid json; if it is, return it. Otherwise, return null.
             try
             {
-                new ObjectMapper().readTree(newValue);
+                JsonUtil.DEFAULT_MAPPER.readTree(newValue);
                 return newValue;
             }
             catch (IOException e)
@@ -388,7 +389,7 @@ private String getBestJson(String currentValue, String newValue, String serverSe
         }
 
         // Rather than overwrite the current json map, merge the new with the current.
-        ObjectMapper mapper = new ObjectMapper();
+        ObjectMapper mapper = JsonUtil.createDefaultMapper();
         try
         {
             log.debug("Merging JSON. Old is " + currentValue.length() + " characters, new is " + newValue.length());
diff --git a/pipeline/src/org/labkey/pipeline/api/PipelineServiceImpl.java b/pipeline/src/org/labkey/pipeline/api/PipelineServiceImpl.java
index 5aa9a84ed01..6f9bef4774c 100644
--- a/pipeline/src/org/labkey/pipeline/api/PipelineServiceImpl.java
+++ b/pipeline/src/org/labkey/pipeline/api/PipelineServiceImpl.java
@@ -67,6 +67,7 @@
 import org.labkey.api.study.FolderArchiveSource;
 import org.labkey.api.trigger.TriggerConfiguration;
 import org.labkey.api.util.FileUtil;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.NetworkDrive;
 import org.labkey.api.util.TestContext;
 import org.labkey.api.util.logging.LogHelper;
@@ -945,7 +946,7 @@ public String startFileAnalysis(AnalyzeForm form, @Nullable Map<String, String>
                 }
                 ParamParser parser = PipelineJobService.get().createParamParser();
                 Map<String, String> params = new HashMap<>();
-                Map<String, Object> parsedMap = new ObjectMapper().readValue(form.getConfigureJson(), new TypeReference<Map<String, Object>>(){});
+                Map<String, Object> parsedMap = JsonUtil.DEFAULT_MAPPER.readValue(form.getConfigureJson(), new TypeReference<Map<String, Object>>(){});
                 for (Map.Entry<String, Object> entry : parsedMap.entrySet())
                 {
                     params.put(entry.getKey(), entry.getValue() == null ? null : entry.getValue().toString());
diff --git a/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp b/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp
index 7e8fe1c068b..1c6c07cc625 100644
--- a/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp
+++ b/pipeline/src/org/labkey/pipeline/createPipelineTrigger.jsp
@@ -30,6 +30,7 @@
 <%@ page import="org.labkey.api.util.UniqueID" %>
 <%@ page import="org.labkey.api.pipeline.trigger.PipelineTriggerRegistry" %>
 <%@ page import="org.labkey.api.util.JsonUtil" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 <%!
@@ -92,10 +93,10 @@
     <div id="<%=h(appId)%>"></div>
 
     <script type="text/javascript" nonce="<%=getScriptNonce()%>">
-        const detailsFormSchema = JSON.parse(<%=q(JsonUtil.DEFAULT_MAPPER.writeValueAsString(detailsFormSchema))%>);
-        const taskFormSchemas = JSON.parse(<%=q(JsonUtil.DEFAULT_MAPPER.writeValueAsString(taskFormSchemas))%>);
-        const customFieldFormSchemas = JSON.parse(<%=q(JsonUtil.DEFAULT_MAPPER.writeValueAsString(customFieldFormSchemas))%>);
-        const tasksHelpText = JSON.parse(<%=q(JsonUtil.DEFAULT_MAPPER.writeValueAsString(tasksHelpText))%>);
+        const detailsFormSchema = JSON.parse(<%=q(JavaScriptFragment.asJson(detailsFormSchema))%>);
+        const taskFormSchemas = JSON.parse(<%=q(JavaScriptFragment.asJson(taskFormSchemas))%>);
+        const customFieldFormSchemas = JSON.parse(<%=q(JavaScriptFragment.asJson(customFieldFormSchemas))%>);
+        const tasksHelpText = JSON.parse(<%=q(JavaScriptFragment.asJson(tasksHelpText))%>);
         const rowId = <%=bean.getRowId()%>;
         const details = {
             "assay provider": <%=q(bean.getAssayProvider())%> || undefined,
diff --git a/query/src/org/labkey/query/controllers/QueryController.java b/query/src/org/labkey/query/controllers/QueryController.java
index 4edbf1d86a6..07347eb1d9f 100644
--- a/query/src/org/labkey/query/controllers/QueryController.java
+++ b/query/src/org/labkey/query/controllers/QueryController.java
@@ -3505,7 +3505,7 @@ public static class GetDataAction extends ReadOnlyApiAction<SimpleApiJsonForm>
         @Override
         public ApiResponse execute(SimpleApiJsonForm form, BindException errors) throws Exception
         {
-            ObjectMapper mapper = new ObjectMapper();
+            ObjectMapper mapper = JsonUtil.createDefaultMapper();
             mapper.configure(DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY, true);
             mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
             JSONObject object = form.getJsonObject();
@@ -7562,10 +7562,9 @@ public void setSchemas(Map<String, List<Map<String, Object>>> schemas)
             PropertyValue schemasProperty = values.getPropertyValue("schemas");
             if (schemasProperty != null && schemasProperty.getValue() != null)
             {
-                ObjectMapper om = new ObjectMapper();
                 try
                 {
-                    _schemas = om.readValue((String)schemasProperty.getValue(), _schemas.getClass());
+                    _schemas = JsonUtil.DEFAULT_MAPPER.readValue((String)schemasProperty.getValue(), _schemas.getClass());
                 }
                 catch (IOException e)
                 {
diff --git a/query/src/org/labkey/query/reports/view/reportsWebPartConfig.jsp b/query/src/org/labkey/query/reports/view/reportsWebPartConfig.jsp
index 382e34b94f4..d63289c2408 100644
--- a/query/src/org/labkey/query/reports/view/reportsWebPartConfig.jsp
+++ b/query/src/org/labkey/query/reports/view/reportsWebPartConfig.jsp
@@ -133,7 +133,7 @@
         {
             var url = "<%=h(urlProvider(ReportUrls.class).urlReportSections(c).addParameter(sectionName, pm.get(sectionName)))%>";
 
-            url = url.concat("&<%=unsafe(PageFlowUtil.encode(ReportDescriptor.Prop.reportId.name()))%>=");
+            url = url.concat(<%=q("&" + PageFlowUtil.encode(ReportDescriptor.Prop.reportId.name()) + "=")%>);
             url = url.concat(element.value);
 
             LABKEY.Ajax.request({
diff --git a/query/src/org/labkey/query/view/externalSchema.jsp b/query/src/org/labkey/query/view/externalSchema.jsp
index 741ec0f4739..a8ef18e7e01 100644
--- a/query/src/org/labkey/query/view/externalSchema.jsp
+++ b/query/src/org/labkey/query/view/externalSchema.jsp
@@ -293,7 +293,7 @@ var f = new LABKEY.ext.FormPanel({
         }
     ],
     buttons:[
-        {text:'<%=text(bean.isInsert() ? "Create" : "Update")%>', type:'submit', handler:submit},
+        {text:<%=q(bean.isInsert() ? "Create" : "Update")%>, type:'submit', handler:submit},
         <% if (!bean.isInsert()) { %>
         {text:'Delete', handler:function() {document.location = <%=q(bean.getDeleteURL())%>;}},
         <% } %>
diff --git a/query/src/org/labkey/query/view/internalSourceView.jsp b/query/src/org/labkey/query/view/internalSourceView.jsp
index 3d1118db029..05ad7648d11 100644
--- a/query/src/org/labkey/query/view/internalSourceView.jsp
+++ b/query/src/org/labkey/query/view/internalSourceView.jsp
@@ -57,7 +57,7 @@
         <br>
         Inherit: <labkey:checkbox id="ff_inherit" name="ff_inherit" value="true" checked="<%=form.ff_inherit%>" /><br>
         Hidden: <labkey:checkbox id="ff_hidden" name="ff_hidden" value="true" checked="<%=form.ff_hidden%>" /><br>
-        Shared: <%=text(view.getCustomViewOwner() == null ? "yes" : "no")%><br>
+        Shared: <%=h(view.getCustomViewOwner() == null ? "yes" : "no")%><br>
         <br>
         Container: <%=h(view.getContainerPath())%><br>
         Created: <%=formatDateTime(view.getCreated())%><br>
diff --git a/specimen/src/org/labkey/specimen/view/configRequestabilityRules.jsp b/specimen/src/org/labkey/specimen/view/configRequestabilityRules.jsp
index c71c6334a25..ece4c3b37c2 100644
--- a/specimen/src/org/labkey/specimen/view/configRequestabilityRules.jsp
+++ b/specimen/src/org/labkey/specimen/view/configRequestabilityRules.jsp
@@ -301,10 +301,10 @@
                     if (viewName)
                         ruleName += ", view " + viewName;
                     const testUrl = getSelectedURL(viewName ? viewCombo : queryCombo);
-                    const markRequestable = actionCombo.getValue() == '<%= h(RequestabilityManager.MarkType.AVAILABLE.getLabel()) %>';
-                    const ruleData = schemaCombo.getValue() + "<%= text(RequestabilityManager.CUSTOM_QUERY_DATA_SEPARATOR) %>" +
-                                   queryCombo.getValue() + "<%= text(RequestabilityManager.CUSTOM_QUERY_DATA_SEPARATOR) %>" +
-                                   viewName + "<%= text(RequestabilityManager.CUSTOM_QUERY_DATA_SEPARATOR) %>" +
+                    const markRequestable = actionCombo.getValue() == <%= qh(RequestabilityManager.MarkType.AVAILABLE.getLabel()) %>;
+                    const ruleData = schemaCombo.getValue() + <%= q(RequestabilityManager.CUSTOM_QUERY_DATA_SEPARATOR) %> +
+                                   queryCombo.getValue() + <%= q(RequestabilityManager.CUSTOM_QUERY_DATA_SEPARATOR) %> +
+                                   viewName + <%= q(RequestabilityManager.CUSTOM_QUERY_DATA_SEPARATOR) %> +
                                    markRequestable;
                     if (addRule(grid, type, ruleName, actionCombo.getValue(), testUrl, ruleData))
                         win.close();
diff --git a/specimen/src/org/labkey/specimen/view/search.jsp b/specimen/src/org/labkey/specimen/view/search.jsp
index fb2343a9715..bc11d1199ba 100644
--- a/specimen/src/org/labkey/specimen/view/search.jsp
+++ b/specimen/src/org/labkey/specimen/view/search.jsp
@@ -79,7 +79,7 @@ Ext4.onReady(function(){
 
     multi.send(function() {
         if (errorMessages.length > 0)
-            Ext4.get('<%=text(renderTarget)%>').update(errorMessages.join("<br>"));
+            Ext4.get(<%=q(renderTarget)%>).update(errorMessages.join("<br>"));
         else
         {
             Ext4.create('LABKEY.ext.SampleSearchPanel', {
diff --git a/study/src/org/labkey/study/model/StudySnapshot.java b/study/src/org/labkey/study/model/StudySnapshot.java
index b1ee77269aa..827d41f8a83 100644
--- a/study/src/org/labkey/study/model/StudySnapshot.java
+++ b/study/src/org/labkey/study/model/StudySnapshot.java
@@ -32,6 +32,7 @@
 import org.labkey.api.study.StudySnapshotType;
 import org.labkey.api.study.Visit;
 import org.labkey.api.util.GUID;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.study.writer.StudyExportContext;
 
 import java.io.IOException;
@@ -161,10 +162,9 @@ public void setRefresh(boolean refresh)
 
     public String getSettings()
     {
-        ObjectMapper mapper = new ObjectMapper();
         try
         {
-            return mapper.writeValueAsString(_settings);
+            return JsonUtil.DEFAULT_MAPPER.writeValueAsString(_settings);
         }
         catch (JsonProcessingException e)
         {
@@ -176,10 +176,9 @@ public String getSettings()
 
     public void setSettings(String settings)
     {
-        ObjectMapper mapper = new ObjectMapper();
         try
         {
-            _settings = mapper.readValue(settings, SnapshotSettings.class);
+            _settings = JsonUtil.DEFAULT_MAPPER.readValue(settings, SnapshotSettings.class);
         }
         catch (IOException e)
         {
diff --git a/study/src/org/labkey/study/query/StudySnapshotTable.java b/study/src/org/labkey/study/query/StudySnapshotTable.java
index 37e55acd9f0..f46c33c5cea 100644
--- a/study/src/org/labkey/study/query/StudySnapshotTable.java
+++ b/study/src/org/labkey/study/query/StudySnapshotTable.java
@@ -36,6 +36,7 @@
 import org.labkey.api.security.permissions.AdminPermission;
 import org.labkey.api.security.permissions.ReadPermission;
 import org.labkey.api.util.HtmlString;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.study.StudySchema;
 
@@ -105,10 +106,9 @@ public String renderURL(RenderContext ctx)
             public void renderGridCellContents(RenderContext ctx, Writer out) throws IOException
             {
                 Object value = getValue(ctx);
-                ObjectMapper jsonMapper = new ObjectMapper();
-                Object jsonValue = jsonMapper.readValue(String.valueOf(value), Object.class);
+                Object jsonValue = JsonUtil.DEFAULT_MAPPER.readValue(String.valueOf(value), Object.class);
 
-                out.write(PageFlowUtil.filter(jsonMapper.writerWithDefaultPrettyPrinter().writeValueAsString(jsonValue), true, true));
+                out.write(PageFlowUtil.filter(JsonUtil.DEFAULT_MAPPER.writerWithDefaultPrettyPrinter().writeValueAsString(jsonValue), true, true));
           }
         });
 
diff --git a/study/src/org/labkey/study/view/assayProgressReport.jsp b/study/src/org/labkey/study/view/assayProgressReport.jsp
index 54f91894d05..95a89aa547e 100644
--- a/study/src/org/labkey/study/view/assayProgressReport.jsp
+++ b/study/src/org/labkey/study/view/assayProgressReport.jsp
@@ -25,6 +25,7 @@
 <%@ page import="java.util.HashMap" %>
 <%@ page import="java.util.Map" %>
 <%@ page import="org.labkey.api.util.JsonUtil" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.study.view.BaseStudyPage" %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 <%!
@@ -62,7 +63,7 @@
 
         new LABKEY.ext4.ProgressReportConfig({
             renderTo    : <%=q(renderId)%>,
-            reportConfig: <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(reportConfig))%>,
+            reportConfig: <%=JavaScriptFragment.asJson(reportConfig)%>,
             returnUrl   : <%=q(form.getReturnUrl())%>
         });
     });
diff --git a/study/src/org/labkey/study/view/datasetVisibility.jsp b/study/src/org/labkey/study/view/datasetVisibility.jsp
index 9931a7ee1e4..40e2b12b2a3 100644
--- a/study/src/org/labkey/study/view/datasetVisibility.jsp
+++ b/study/src/org/labkey/study/view/datasetVisibility.jsp
@@ -35,6 +35,7 @@
 <%@ page import="java.util.List" %>
 <%@ page import="java.util.Map" %>
 <%@ page import="org.labkey.api.util.JsonUtil" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.study.view.BaseStudyPage" %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 <%!
@@ -244,7 +245,7 @@
 
     Ext4.onReady(function()
     {
-        var datasetInfo = <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(datasetInfo))%>;
+        var datasetInfo = <%=JavaScriptFragment.asJson(datasetInfo)%>;
         var store = LABKEY.study.DataViewUtil.getViewCategoriesStore({
             storeId : '<%=h(storeId)%>',
             container: <%=q((sharedStudy != null ? sharedStudy.getContainer() : study.getContainer()).getPath())%>
diff --git a/study/src/org/labkey/study/view/manageMasterPatientConfig.jsp b/study/src/org/labkey/study/view/manageMasterPatientConfig.jsp
index 640464b255b..be8ad1fcbfb 100644
--- a/study/src/org/labkey/study/view/manageMasterPatientConfig.jsp
+++ b/study/src/org/labkey/study/view/manageMasterPatientConfig.jsp
@@ -37,6 +37,7 @@
 <%@ page import="java.util.List" %>
 <%@ page import="java.util.Map" %>
 <%@ page import="org.labkey.api.util.JsonUtil" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.FormPage" %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 
@@ -70,7 +71,7 @@
 <script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     (function($){
-        var datasetMap = <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(datasetMap))%>;
+        var datasetMap = <%=JavaScriptFragment.asJson(datasetMap)%>;
         var selectedDataset = <%=q(!StringUtils.isBlank(settings.getDataset()) ? settings.getDataset() : "")%>;
         var selectedField = <%=q(!StringUtils.isBlank(settings.getFieldName()) ? settings.getFieldName() : "")%>;
 
diff --git a/study/src/org/labkey/study/view/renderAssayProgressReport.jsp b/study/src/org/labkey/study/view/renderAssayProgressReport.jsp
index 3ef70a7a604..4040c97fa66 100644
--- a/study/src/org/labkey/study/view/renderAssayProgressReport.jsp
+++ b/study/src/org/labkey/study/view/renderAssayProgressReport.jsp
@@ -25,6 +25,7 @@
 <%@ page import="java.util.List" %>
 <%@ page import="java.util.Map" %>
 <%@ page import="org.labkey.api.util.JsonUtil" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.study.view.BaseStudyPage" %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 <%!
@@ -58,8 +59,8 @@
             new LABKEY.ext4.AssayProgressReport({
                 renderTo        : <%=q(renderId)%>,
                 reportId        : <%=q(form.getId().toString())%>,
-                assays          : <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(assays))%>,
-                legend          : <%=unsafe(JsonUtil.DEFAULT_MAPPER.writeValueAsString(legend))%>
+                assays          : <%=JavaScriptFragment.asJson(assays)%>,
+                legend          : <%=JavaScriptFragment.asJson(legend)%>
             });
         });
     </labkey:loadClientDependencies>
diff --git a/study/src/org/labkey/study/view/subjects.jsp b/study/src/org/labkey/study/view/subjects.jsp
index f338764cc45..bc30dce22ce 100644
--- a/study/src/org/labkey/study/view/subjects.jsp
+++ b/study/src/org/labkey/study/view/subjects.jsp
@@ -47,6 +47,7 @@
 <%@ page import="java.util.HashMap" %>
 <%@ page import="static org.labkey.api.util.HtmlString.EMPTY_STRING" %>
 <%@ page import="java.util.List" %>
+<%@ page import="org.labkey.api.util.JavaScriptFragment" %>
 <%@ page extends="org.labkey.api.jsp.JspBase" %>
 <%!
     @Override
@@ -211,7 +212,7 @@
         }
         %>];
 
-        var hasCohorts = <%=text(hasCohorts?"true":"false")%>;
+        var hasCohorts = <%=JavaScriptFragment.bool(hasCohorts) %>;
 
 <%
         int size = index;
@@ -733,7 +734,7 @@
 })();
 
 
-Ext4.onReady(<%=unsafe(viewObject)%>.render, <%=unsafe(viewObject)%>);
+Ext4.onReady(<%=JavaScriptFragment.unsafe(viewObject)%>.render, <%=JavaScriptFragment.unsafe(viewObject)%>);
 </script>
 
 <div id="<%= h(outerDivId) %>">
diff --git a/survey/src/org/labkey/survey/SurveyManager.java b/survey/src/org/labkey/survey/SurveyManager.java
index ee762fa1e26..ceb7ceaa4b3 100644
--- a/survey/src/org/labkey/survey/SurveyManager.java
+++ b/survey/src/org/labkey/survey/SurveyManager.java
@@ -707,8 +707,7 @@ public MultiValuedMap<String, SurveyDesign> load(Stream<? extends Resource> reso
      */
     public static String validateSurveyMetadata(String metadata) throws IOException
     {
-        ObjectMapper mapper = new ObjectMapper();
-        mapper.readTree(metadata);
+        JsonUtil.DEFAULT_MAPPER.readTree(metadata);
         StringBuilder sb = new StringBuilder();
 
         try
diff --git a/visualization/src/org/labkey/visualization/VisualizationController.java b/visualization/src/org/labkey/visualization/VisualizationController.java
index b89401041fc..0974b4fe1b5 100644
--- a/visualization/src/org/labkey/visualization/VisualizationController.java
+++ b/visualization/src/org/labkey/visualization/VisualizationController.java
@@ -91,6 +91,7 @@
 import org.labkey.api.study.StudyService;
 import org.labkey.api.thumbnail.ThumbnailService;
 import org.labkey.api.thumbnail.ThumbnailService.ImageType;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.Pair;
 import org.labkey.api.util.ResponseHelper;
@@ -1648,7 +1649,7 @@ public static class TestCase extends Assert
         @Test
         public void testJacksonBinding() throws Exception
         {
-            ObjectReader r = new ObjectMapper().reader(VisDataRequest.class)
+            ObjectReader r = JsonUtil.DEFAULT_MAPPER.reader(VisDataRequest.class)
                     .without(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
             String measure1 = "{\"allowNullResults\":true, \"aggregate\":\"MAX\", \"alias\":\"table_column\", " +
                     "\"inNotNullSet\":true, \"name\":\"column\", \"nsvalues\":\"whatisthis\"," +
diff --git a/visualization/src/org/labkey/visualization/VisualizationServiceImpl.java b/visualization/src/org/labkey/visualization/VisualizationServiceImpl.java
index 8e2c2408c69..66b0bc45616 100644
--- a/visualization/src/org/labkey/visualization/VisualizationServiceImpl.java
+++ b/visualization/src/org/labkey/visualization/VisualizationServiceImpl.java
@@ -35,6 +35,7 @@
 import org.labkey.api.query.UserSchema;
 import org.labkey.api.security.User;
 import org.labkey.api.study.DatasetTable;
+import org.labkey.api.util.JsonUtil;
 import org.labkey.api.util.Pair;
 import org.labkey.api.view.ViewContext;
 import org.labkey.api.visualization.SQLGenerationException;
@@ -63,8 +64,7 @@ public SQLResponse getDataGenerateSQL(Container c, User user, JSONObject json) t
         ViewContext context = new ViewContext();
         context.setUser(user);
         context.setContainer(c);
-
-        ObjectReader r = new ObjectMapper().reader(VisDataRequest.class).without(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
+        ObjectReader r = JsonUtil.DEFAULT_MAPPER.reader(VisDataRequest.class).without(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
         VisDataRequest vdr = r.readValue(json.toString());
         vdr.setMetaDataOnly(true);
 
@@ -85,7 +85,7 @@ public SQLResponse getDataCDSGenerateSQL(Container c, User user, JSONObject json
         context.setUser(user);
         context.setContainer(c);
 
-        ObjectReader r = new ObjectMapper().reader(VisDataRequest.class).without(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
+        ObjectReader r = JsonUtil.DEFAULT_MAPPER.reader(VisDataRequest.class).without(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
         VisDataRequest vdr = r.readValue(json.toString());
         vdr.setMetaDataOnly(true);
 
diff --git a/visualization/src/org/labkey/visualization/views/chartWizard.jsp b/visualization/src/org/labkey/visualization/views/chartWizard.jsp
index 9a9a3ae5910..a7509b01601 100644
--- a/visualization/src/org/labkey/visualization/views/chartWizard.jsp
+++ b/visualization/src/org/labkey/visualization/views/chartWizard.jsp
@@ -125,7 +125,7 @@
             canEdit: canEdit,
             canShare: <%=canShare%>,
             isDeveloper: <%=isDeveloper%>,
-            defaultNumberFormat: eval("<%=text(numberFormatFn)%>"),
+            defaultNumberFormat: eval(<%=q(numberFormatFn)%>),
             allowEditMode: <%=allowEditMode%>,
             editModeURL: editUrl,