JSON character encoding – is UTF-8 well-supported by browsers or should I use numeric escape sequences?

by

The JSON spec requires UTF-8 support by decoders. As a result, all JSON decoders can handle UTF-8 just as well as they can handle the numeric escape sequences. This is also the case for Javascript interpreters, which means JSONP will handle the UTF-8 encoded JSON as well.

The ability for JSON encoders to use the numeric escape sequences instead just offers you more choice. One reason you may choose the numeric escape sequences would be if a transport mechanism in between your encoder and the intended decoder is not binary-safe.

Another reason you may want to use numeric escape sequences is to prevent certain characters appearing in the stream, such as <, & and ", which may be interpreted as HTML sequences if the JSON code is placed without escaping into HTML or a browser wrongly interprets it as HTML. This can be a defence against HTML injection or cross-site scripting (note: some characters MUST be escaped in JSON, including " and \).

Some frameworks, including PHP’s json_encode() (by default), always do the numeric escape sequences on the encoder side for any character outside of ASCII. This is a mostly unnecessary extra step intended for maximum compatibility with limited transport mechanisms and the like. However, this should not be interpreted as an indication that any JSON decoders have a problem with UTF-8.

So, I guess you just could decide which to use like this:

  • Just use UTF-8, unless any software you are using for storage or transport between encoder and decoder isn’t binary-safe.

  • Otherwise, use the numeric escape sequences.

More Related Contents:

  1. Saving utf-8 texts with json.dumps as UTF8, not as \u escape sequence
  2. Reference: Why are my “special” Unicode characters encoded weird using json_encode?
  3. Is There a JSON Parser for VB6 / VBA?
  4. How do I upload a file with metadata using a REST web service?
  5. Spring, Jackson and Customization (e.g. CustomDeserializer)
  6. Saving UTF-8 texts with json.dumps as UTF-8, not as a \u escape sequence
  7. Load data from Webservice (asmx) to jqgrid. Please help me
  8. What’s the difference between UTF-8 and UTF-8 without BOM?
  9. Why does modern Perl avoid UTF-8 by default?
  10. u’\ufeff’ in Python string
  11. UTF-8, UTF-16, and UTF-32
  12. What’s the difference between Unicode and UTF-8? [duplicate]
  13. How do I check if a string is unicode or ascii?
  14. Manually converting unicode codepoints into UTF-8 and UTF-16
  15. Secure Web Services: REST over HTTPS vs SOAP + WS-Security. Which is better? [closed]
  16. How to obtain longitude and latitude for a street address programmatically (and legally)
  17. Read a UTF-8 text file with BOM
  18. How to pass a JSON array as a parameter in URL
  19. C programming: How to program for Unicode?
  20. What is a web service endpoint?
  21. python encoding utf-8
  22. PHP json_encode json_decode UTF-8
  23. encoding of query string parameters in IE10
  24. Non-CRUD operations in a RESTful service
  25. What should a JSON service return on failure / error
  26. UnicodeDecodeError when performing os.walk
  27. How can I treat command-line arguments as UTF-8 in Perl?
  28. What are the benefits of using Nginx in front of a webserver for Go?
  29. What is the difference between ?wsdl and ?singleWsdl parameters
  30. Server-Side XML Validation with CXF Webservice

Leave a Comment