Take the 2-minute tour ×

As per title, is it considered a good practice to put HTML in JSON? The reason I need to do this is because I would like to have a custom dropdown where the list is coming from the user input, and the json looks like so:

{ listTitle: 'Tasks', listHtml: '<ul><li></li>...</ul>' }

and I have the foreach as following (keep in mind this is a stripped down version of my code, validation is in place, but for the sake of this question I took them out)

$list = /** Code to grab 'Tasks' list and its title from mysql **/;
$title = 'Tasks';
$listHtml = '';
foreach($list as $content) { $listHtml .= '<li>' . htmlspecialchars($content, ENT_QUOTES, 'UTF-8') . '</li>'; }

   'title' => $title, 'listHtml' => '<ul>' . $listHtml . '</ul>'

My worry is that there might be some special characters that might break the JSON String. Please help.

share|improve this question
It's just a string. Strings are supported in JSON. Even those with HTML in it ;) - see json.org –  hakre Feb 29 '12 at 2:54
@andreas: separation of presentation from data seems to be the main point of formats like JSON. Do you intend to let other websites or users fetch this data on the side and use it outside of your website? If so, adding in html will ruin that. If not, if this is a json feed you use only to help build your webpages, then it would be up to you. –  bob-the-destroyer Feb 29 '12 at 2:56
@bob Eh? I thought cross domain policy is in place for things like you mentioned? So unless I willingly write callback support on the script, I should be ok? Please enlighten me –  SiGanteng Feb 29 '12 at 2:58
@andreas: cross-domain policy only affects the use of XMLHttpRequest and similar objects on your own website, not the actual source of your json feed/string. Different things. If your server is internet-facing, and unless protected by server settings or user access control, your json feed is open to the public. Do you prefer that external users have freedom to use this feed as they wish? Or do you prefer it just be used to only help dynamically build your own website? –  bob-the-destroyer Feb 29 '12 at 3:07
Ah ok, makes sense. But this is a generated user list, so there's session checking on the server to see if the user is logged in. Thanks for the insight :) –  SiGanteng Feb 29 '12 at 3:09
show 1 more comment

3 Answers

up vote 12 down vote accepted

You wouldn't be the first to do it, and certainly not the last.

To really answer the question, assuming you're following the protocol/standard and not breaking it (including quotes in the string without escaping them, for instance) you should be fine. json_encode does a great job at all this, but as @Kolink mentioned make sure you encode it to UTF8 first otherwise stray Unicode characters will occasionally break it resulting in empty output.

Beyond that, it's programmer preference to use it. Some avoid it and keep the UI work on the page, others have the server generate the UI and let JavaScript just dump it--either way it's your call, and perfectly acceptable.

share|improve this answer
thanks brad! certainly helpful and thorough answer :) –  SiGanteng Feb 29 '12 at 3:06
As a follow-up, libraries like Knockout JS allow very easy convergence of JSON data and UI integration using an easy-to-use templating system. –  Brad Christie Jul 26 '12 at 15:17
add comment

There's nothing wrong with it. json_encode escapes all characters anyway, so the only thing you have to beware of is make sure your strings are utf8_encoded.

share|improve this answer
add comment

You could, sure, but you could just as easily pass the values as an array in the JSON and put the HTML rendering code in the client; saving you server cycles, bandwidth bytes, and logic-presentation blending.

share|improve this answer
add comment

Your Answer


