When using json_encode to print variables from PHP to javascript like :

const field = <?= json_encode($_GET['field']) ?>;

Is there any XSS or other injection risk ? These variables won't be used in any SQL related task but javascript only. I don't want the user to be able to pass/execute any JS code through the GET parameter.

EDIT : I can't seem to get a definite answer so I'll try to ask it differently : I want to print $_GET['field'] and be guaranteed that whatever it's contents are, it'll be in the field constant as a string, what's the best way to achieve that ? I'm using json_encode($_GET['field'], JSON_HEX_TAG|JSON_UNESCAPED_UNICODE) at the moment.