diff --git a/api/src/org/labkey/api/data/JsonTest.java b/api/src/org/labkey/api/data/JsonTest.java
index 0ad347a0582..d1e1378eb42 100644
--- a/api/src/org/labkey/api/data/JsonTest.java
+++ b/api/src/org/labkey/api/data/JsonTest.java
@@ -101,12 +101,14 @@ public void jsonOrgViaJackson() throws IOException
         obj.put("str", "hello");
         obj.put("arr", new JSONArray(Arrays.asList("one", null, 3, new JSONObject(Collections.singletonMap("four", 4)))));
         obj.put("nul", (Object)null);
+        obj.put("key", "</tricky\tvalue\\");
 //        obj.put("d", d);  //TODO: new JSONObject serializes date-times as ISO
 
         // Verify serializing JSONObject via Jackson is equivalent
         String jacksonToString = mapper.writeValueAsString(obj);
         String jsonOrgToString = obj.toString();
         assertEquals(jsonOrgToString, jacksonToString);
+        assertTrue(jsonOrgToString.contains("<\\/"));
 
         // Verify deserializing JSONObject via Jackson is equivalent
         // NOTE: In both cases, the date value is deserialized as a string because JSON sucks
diff --git a/api/src/org/labkey/api/notification/notificationpanel.jsp b/api/src/org/labkey/api/notification/notificationpanel.jsp
index 230c386572e..6b6146def1c 100644
--- a/api/src/org/labkey/api/notification/notificationpanel.jsp
+++ b/api/src/org/labkey/api/notification/notificationpanel.jsp
@@ -43,7 +43,7 @@
     %>
     <a id="<%=h(linkId)%>" href="#">
         <i class="fa fa-inbox labkey-notification-inbox"></i>
-        <span id=<%=q(notificationCountId)%>>&nbsp;</span>
+        <span id="<%=h(notificationCountId)%>">&nbsp;</span>
     </a>
 </li>
 
diff --git a/api/src/org/labkey/api/reports/report/r/RReport.java b/api/src/org/labkey/api/reports/report/r/RReport.java
index ddd87e0e3fa..9498d006c12 100644
--- a/api/src/org/labkey/api/reports/report/r/RReport.java
+++ b/api/src/org/labkey/api/reports/report/r/RReport.java
@@ -219,12 +219,48 @@ public static synchronized String getDefaultRPath()
         return DEFAULT_APP_PATH;
     }
 
+
     public static String toR(String s)
     {
-        String r = PageFlowUtil.jsString(s);
-        return "\"" + StringUtils.strip(r, "'") + "\"";
+        if (s == null)
+            return "\"\"";
+
+        StringBuilder r = new StringBuilder(s.length() + 10);
+        r.append("\"");
+        int len = s.length();
+        for (int i = 0 ; i<len ; i++)
+        {
+            char c = s.charAt(i);
+            switch (c)
+            {
+                case '\\':
+                    r.append("\\\\");
+                    break;
+                case '\n':
+                    r.append("\\n");
+                    break;
+                case '\r':
+                    r.append("\\r");
+                    break;
+                case '\'':
+                    r.append("\\'");
+                    break;
+                case '\"':
+                    r.append("\\\"");
+                    break;
+                case '\t':
+                    r.append("\\t");
+                    break;
+                default:
+                    r.append(c);
+                    break;
+            }
+        }
+        r.append("\"");
+        return r.toString();
     }
 
+
     // static for access by RserveScriptEngine with no backing report
     public static void appendParamList(StringBuilder labkey, Map<String, Object> inputParameters)
     {
diff --git a/api/src/org/labkey/api/util/PageFlowUtil.java b/api/src/org/labkey/api/util/PageFlowUtil.java
index fa14871d328..a441ff56898 100644
--- a/api/src/org/labkey/api/util/PageFlowUtil.java
+++ b/api/src/org/labkey/api/util/PageFlowUtil.java
@@ -435,6 +435,9 @@ public static String jsString(String s)
                 case '\\':
                     js.append("\\\\");
                     break;
+                case '/':
+                    js.append("\\/");
+                    break;
                 case '\n':
                     js.append("\\n");
                     break;
diff --git a/core/src/org/labkey/core/CoreModule.java b/core/src/org/labkey/core/CoreModule.java
index 7c0958107ab..a84a80c8160 100644
--- a/core/src/org/labkey/core/CoreModule.java
+++ b/core/src/org/labkey/core/CoreModule.java
@@ -15,6 +15,7 @@
  */
 package org.labkey.core;
 
+import com.fasterxml.jackson.core.io.CharTypes;
 import com.google.common.collect.Sets;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
@@ -316,6 +317,18 @@ public class CoreModule extends SpringModule implements SearchService.DocumentPr
 
         // Register dialect extra early, since we need to initialize the data sources before calling DefaultModule.initialize()
         SqlDialectRegistry.register(new PostgreSqlDialectFactory());
+
+        try
+        {
+            var field = CharTypes.class.getDeclaredField("sOutputEscapes128");
+            field.setAccessible(true);
+            ((int[])field.get(null))['/'] = '/';
+            field.setAccessible(false);
+        }
+        catch (NoSuchFieldException|IllegalArgumentException|IllegalAccessException x)
+        {
+            // pass
+        }
     }
 
     private CoreWarningProvider _warningProvider;
diff --git a/core/src/org/labkey/core/user/securityAccess.jsp b/core/src/org/labkey/core/user/securityAccess.jsp
index 7d8c722748a..e14a8848ff8 100644
--- a/core/src/org/labkey/core/user/securityAccess.jsp
+++ b/core/src/org/labkey/core/user/securityAccess.jsp
@@ -79,7 +79,7 @@
     However, if this account were re-enabled, it would have the following permissions.</div>
 <% } %>
 
-<table id=<%=q(accessRegion.getDomId())%> lk-region-name=<%=q(accessRegion.getName())%> class="labkey-data-region-legacy labkey-show-borders">
+<table id="<%=h(accessRegion.getDomId())%>" lk-region-name="<%=h(accessRegion.getName())%>" class="labkey-data-region-legacy labkey-show-borders">
     <colgroup><col><col><col></colgroup>
     <tr id="dataregion_column_header_row_access">
         <th>&nbsp;</th>
diff --git a/pipeline/src/org/labkey/pipeline/startPipelineImport.jsp b/pipeline/src/org/labkey/pipeline/startPipelineImport.jsp
index e8443444bc3..01fcaeccc1b 100644
--- a/pipeline/src/org/labkey/pipeline/startPipelineImport.jsp
+++ b/pipeline/src/org/labkey/pipeline/startPipelineImport.jsp
@@ -62,7 +62,7 @@
 <labkey:errors/>
 <labkey:form id="<%=importFormId%>" action="<%=urlFor(StartFolderImportAction.class)%>" method="post">
     <input type="hidden" name="fromZip" value=<%=bean.isFromZip()%>>
-    <input type="hidden" name="filePath" value=<%=q(bean.getFilePath())%>>
+    <input type="hidden" name="filePath" value="<%=h(bean.getFilePath())%>">
     <div id="startPipelineImportForm"></div>
 </labkey:form>
 
diff --git a/survey/src/org/labkey/survey/view/customizeSurveysWebPart.jsp b/survey/src/org/labkey/survey/view/customizeSurveysWebPart.jsp
index 833abb6289d..cb787d61612 100644
--- a/survey/src/org/labkey/survey/view/customizeSurveysWebPart.jsp
+++ b/survey/src/org/labkey/survey/view/customizeSurveysWebPart.jsp
@@ -40,7 +40,7 @@
 %>
 
 This webpart displays a list of survey instances created by the end user. Select which survey design this webpart should use:<br><br>
-<div id=<%=q(divId)%>></div>
+<div id="<%=h(divId)%>"></div>
 
 <script type="text/javascript" nonce="<%=getScriptNonce()%>">
     Ext4.onReady(function(){
diff --git a/survey/src/org/labkey/survey/view/surveyWizard.jsp b/survey/src/org/labkey/survey/view/surveyWizard.jsp
index 61886ce2c68..5320efae55b 100644
--- a/survey/src/org/labkey/survey/view/surveyWizard.jsp
+++ b/survey/src/org/labkey/survey/view/surveyWizard.jsp
@@ -76,9 +76,9 @@
     else
     {
 %>
-<div id=<%=q(headerRenderId)%>></div>
-<div id=<%=q(formRenderId)%>></div>
-<div id=<%=q(footerRenderId)%>></div>
+<div id="<%=h(headerRenderId)%>"></div>
+<div id="<%=h(formRenderId)%>"></div>
+<div id="<%=h(footerRenderId)%>"></div>
 <script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){