JSON in HTML escaping

Question

I'm including JSON in an HTML tag, considering the only possible input characters for the JSON will be "':{},[a-z][0-9] is it possible for JSON or HTML to be broken with my approach? What should I be wary of when using JSON across HTML and Javascript?

<input type="hidden" value="<?=htmlspecialchars(json_encode($myArray));?>" />

JSON allows for JS strings, which can include the HTML/SGML/XML special characters <, >, & (and " and ' if used in HTML attributes). — Lucero
– Lucero, Commented Jun 18, 2012 at 20:18

Bergi · Accepted Answer · 2012-06-18 20:51:04Z

1

JSON can contain nearly any character in its strings. As you are using it in an attribute, ~~escape_quotes~~addslashes should be enough, that depends on your (X)HTML version. htmlspecialchars is OK anyway.

edited Jun 18, 2012 at 20:51

answered Jun 18, 2012 at 20:29

Bergi

671k162 gold badges1k silver badges1.5k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

el_pup_le Over a year ago

this one? php.net/manual/en/function.addslashes.php someone said don't escape single quotes for JSON. Why wouldn't you want to do this?

Bergi Over a year ago

You're right, thanks. You don't need to escape single quotes, only when you use them as HTML attribute delimiters...

Jarry · Accepted Answer · 2012-06-18 20:21:36Z

1

in the definition of json, one of the posible values its a string. which can contain <, > among other things

you can use a base64 enconding to avoid this.

answered Jun 18, 2012 at 20:21

Jarry

1,9063 gold badges16 silver badges27 bronze badges

2 Comments

Dre Over a year ago

May be a good idea to use urlsafe base64 if you base64 it. ( base64 with - instead of + and _ instead of /, optionally with padding dropped ) to avoid the text being encoded.Probably not required, but would save some space with the text.

Jarry Over a year ago

AFAIK urlsafe its not standard, and its more complicated to get encoder/decoder. but i may be wrong

Collectives™ on Stack Overflow

JSON in HTML escaping

2 Answers 2

2 Comments

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Related