Json: PHP to JavaScript safe or not?

by

In terms of pure JavaScript, yes, you are safe: the output of json_encode can never containing anything but static values which will have no unexpected side effected when passed to eval. (Though you typically have to surround your JSON string with () when using eval, to avoid it misinterpreting an object literal expression as a statement block.)

Aside: this is not necessarily true of all JSON encoders because there are some characters that are valid to include raw in a JSON string that are not valid raw in JavaScript. Most notably, U+2028 and U+2029 which can’t go unescaped in JavaScript string literals as they constitute newlines. However PHP’s encoder encodes all non-ASCII characters (eg as "\u2028") so no issue here.

In terms of JavaScript embedded in another language (typically: HTML) you are not necessarily safe. For example:

<script type="text/javascript">
    var v= <?php echo json_encode($value); ?>;
</script>

In this example, what if value contains a string with the character sequence </script? This would allow the value to end the script block prematurely and thus escape into HTML markup, where it could then inject other malicious script.

To avoid this problem, when including JSON content in HTML, always encode the < character in string literals, as \x3C or, in JSON-compliant terms, \u003C. For compatibility with XHTML non-CDATA script blocks, do & as well. For compatibility with JS inside event handler attributes, do quotes as well.

PHP will do this for you with the right options to json_encode():

var v= <?php echo json_encode($value, JSON_HEX_QUOT|JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS); ?>;

(You may want to define a shortcut function to make this quicker to write.)

More Related Contents:

  1. How to create this type of JSON data from PHP [closed]
  2. How to extract and access data from JSON with PHP?
  3. How to convert JSON string to array
  4. What are the best practices for avoiding xss attacks in a PHP site [closed]
  5. When should I use prepared statements?
  6. “Keep Me Logged In” – the best approach
  7. json_encode PHP array as JSON array not JSON object
  8. How safe are PHP session variables?
  9. Generating a random password in php
  10. Facebook Graph API, how to get users email?
  11. php: loop through json array
  12. Preventing session hijacking
  13. Why is using a mysql prepared statement more secure than using the common escape functions?
  14. Merging two json in PHP
  15. “slash before every quote” problem [duplicate]
  16. How to create a laravel hashed password
  17. json_encode function: special characters
  18. How to process JSON in PHP?
  19. PHP Create a Multidimensional Array from an array with relational data [duplicate]
  20. Retrieve JSON POST data in CodeIgniter
  21. How to add square braces around subarray data inside of a json encoded string?
  22. PHP- Decode JSON
  23. Posting JSON objects to Symfony 2
  24. Removing array index reference when using json_encode()
  25. Ajax call with contentType: ‘application/json’ not working
  26. How to decode a JSON string in PHP?
  27. Escaping/encoding single quotes in JSON encoded HTML5 data attributes
  28. Session timeouts in PHP: best practices
  29. How to search through a JSON Array in PHP
  30. Read JSON Data Using PHP [duplicate]

Leave a Comment