Parameterize them with <c:set> .
<c:set var="search" value='"' /> <c:set var="replace" value='\\"' /> <c:out value="${fn:replace(userName, search, replace)}"/>
Not tied to a specific question, have you yet considered a real JSON generator? For example, using Gson, this is a question of the following oneliner, given that user is a full-fledged javabei:
String json = new Gson().toJson(user);
You will get syntactically valid JSON directly, without confusing all the ways to get JSP / JSTL / EL to create valid JSON.
source share