src/Parser/Tokenizer.php
protected function scanString()
    {
        $len = strlen($this->source);
        $this->pos++;

        $value = '';
        while ($this->pos < $len) {
            $ch = $this->source[$this->pos];
            if ($ch === '"') {
                $token = new Token(Token::TYPE_STRING, $this->getLine(), $this->getColumn(), $value);
                $this->pos++;

                return $token;
            }
            
            if($ch === '\\' && ($this->pos < ($len - 1))) {
                $this->pos++;
                $ch = $this->source[$this->pos];
                switch($ch) {
                    case '"':
                    case '\\':
                    case '/':
                        break;
                    case 'b':
                        $ch = sprintf("%c", 8);
                        break;
                    case 'f':
                        $ch = "\f";
                        break;
                    case 'n':
                        $ch = "\n";
                        break;
                    case 'r':
                        $ch = "\r";
                        break;
                    case 'u':
                        $codepoint = substr($this->source, $this->pos + 1, 4);
                        if( !preg_match('/[0-9A-Fa-f]{4}/', $codepoint)) {
                            throw $this->createException(sprintf('Invalid string unicode escape sequece "%s"', $codepoint));
                        }
                        $ch = html_entity_decode("&#x{$codepoint};", ENT_QUOTES, 'UTF-8');
                        $this->pos += 4;
                        break;
                    default:
                        throw $this->createException(sprintf('Unexpected string escaped character "%s"', $ch));
                        break;

                }
            } 
            
            $value .= $ch;
            $this->pos++;
        }

        throw $this->createUnexpectedTokenTypeException(Token::TYPE_END);
    }
protected function scanString()
    {
        $len = strlen($this->source);
        $this->pos++;

        $value = '';
        while ($this->pos < $len) {
            $ch = $this->source[$this->pos];
            if ($ch === '"') {
                $token = new Token(Token::TYPE_STRING, $this->getLine(), $this->getColumn(), $value);
                $this->pos++;

                return $token;
            }
            
            if($ch === '\\' && ($this->pos < ($len - 1))) {
                $this->pos++;
                $ch = $this->source[$this->pos];
                switch($ch) {
                    case '"':
                    case '\\':
                    case '/':
                        break;
                    case 'b':
                        $ch = sprintf("%c", 8);
                        break;
                    case 'f':
                        $ch = "\f";
                        break;
                    case 'n':
                        $ch = "\n";
                        break;
                    case 'r':
                        $ch = "\r";
                        break;
                    case 'u':
                        $codepoint = substr($this->source, $this->pos + 1, 4);
                        if( !preg_match('/[0-9A-Fa-f]{4}/', $codepoint)) {
                            throw $this->createException(sprintf('Invalid string unicode escape sequece "%s"', $codepoint));
                        }
                        $ch = html_entity_decode("&#x{$codepoint};", ENT_QUOTES, 'UTF-8');
                        $this->pos += 4;
                        break;
                    default:
                        throw $this->createException(sprintf('Unexpected string escaped character "%s"', $ch));
                        break;

                }
            } 
            
            $value .= $ch;
            $this->pos++;
        }

        throw $this->createUnexpectedTokenTypeException(Token::TYPE_END);
    }
/*
http://facebook.github.io/graphql/October2016/#sec-String-Value