Code On Fire Passionate About Cool Code

Why a JSON parser for JavaScript?

JSON is a proper subset of JavaScript, effectively reflecting the definition of a JavaScript object. The easiest way to parse a JSON string into a JavaScript object is using the eval statement:

var obj=eval(‘(‘+jsonString+’)’);

And therein lies the problem. Eval statements are dangerous, especially in a web2.0 environment and can be abused if your evaluation string is contaminated by content you don’t control. Even if your server side code does JSON encoding you could still end up with some severe problems. For example:

jsonString={a:new function(){document.body.innerHTML=”This script just hijacked your page”;}}

That is why JSON parsers that don’t make use of eval is recommended. The smallest and best one I’ve come across can be found at http://code.google.com/p/json-sans-eval/