Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Can a json string contain HTML tags with it?

Tags:

json

html

Consider this my json string,

[{
  "Mat_id": "2",
  "Mat_Name": "Steel",
  "Measurement": "mm",
  "Description": "Steel"
}]

Can i add HTML Tags inside this json string like this,

[{
  "Mat_id": "2",
  "Mat_Name": "Steel",
  "Measurement": "<bold>mm</bold>",
  "Description": "Steel"
}]
  • Whether this is a valid json string?
  • When Eval('('+ thisstring +')') will raise an issue? If so what is it?

I am doing so because i will pass this json object to a yui datatable which consumes json datasource...

EDIT:

This my resulted json string,

{
  "Table": [{
    "Mat_id": "2",
    "Mat_Name": "Jully",
    "Measurement": "<bold>Inches</bold>",
    "Description": "Gully"
  }, ]
}

But i didnt get my Measurement column values in bold...

like image 389
ACP Avatar asked Jan 28 '10 02:01

ACP


People also ask

Can JSON contain HTML tags?

JSON should not contain HTML for tactical/ease of programming purposes unless the HTML is there as part of a larger design, but there may or may not be implementation restrictions.

What is not allowed in JSON?

The following characters are reserved characters and can not be used in JSON and must be properly escaped to be used in strings. Backspace to be replaced with \b. Form feed to be replaced with \f. Newline to be replaced with \n. Carriage return to be replaced with \r.

What characters are allowed in JSON string?

According to JSON.org, a string is a sequence of zero or more Unicode characters, wrapped in double quotes, using backslash escapes. Any valid string can be used as a JSON key. These keys must be enclosed in the double-quotes ( " ). This means if the key name contains any double quote in it, then it must be escaped.


3 Answers

Technically, yes, you can do that... practically, I'd be a bit concerned if there were HTML markup in my data. What else might be in there? Smells like an XSS vulnerability.

like image 137
Aaronaught Avatar answered Oct 26 '22 07:10

Aaronaught


use Encoder.js from http://code.google.com/p/jsool/source/browse/jsool-site/js/util/Encoder.js?r=176

when getting data use

Encoder.htmlDecode(value);

and when passing data use

Encoder.htmlDecode(value);

like image 30
Paras Avatar answered Oct 26 '22 06:10

Paras


Yeah.. no problem with that. :)

like image 32
Thiago Belem Avatar answered Oct 26 '22 07:10

Thiago Belem