Re: JSON compatibility

On Mon, 2007-05-07 at 08:46 -0700, Douglas Crockford wrote:
> <script>
> var myjsondata = {
>     "illegalHTML": "</",
>     "legalHTML": "<\/"
> };
> </script>

I fail to see why this is singled out as opposed to:

	<script><![CDATA[
	var myjsondata = {
	    "illegalHTML": "]]>"
	};
	]]></script>

Not to mention:

	<script><!--
	var myjsondata = {
	    "illegalHTML": "-->"
	};
	--></script>

Or even:

	<script>
	var myjsondata = {
	    "illegalHTML": "<? or ?> or <!--",
	};
	</script>

BTW, the '-->' is particularly nasty because 'j-->2' is a valid
JavaScript expression. Humans will use spaces 'j-- > 2', but JavaScript
compactors have no such qualms.

I guess we should be thankful that JSON has stopped with "\/" :-) You'd
also need "\>", "\?" and "\!" to be completely safe. Of course, if you
go that far, it seems you are better off properly escaping strings you
are dumping into an X/HTML document in the first place (using entities).

Have fun,

	Oren Ben-Kiki


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/