 <h1>Don't use eval for JSON parsing</h1> <p>Don't do it.</p> <p>It's very likely that your server will never become compromised, and that your application will be mostly secure, blah blah blah, that's not the point. It <em>is</em> possible for a server to become partially compromised (too many vectors of attack, what if the php <code>json_encode</code> function became compromised on your server?).</p> <p>The simple solution is not to trust <em>anything</em> sent by <em>anyone</em>. Modern browsers have native JSON parsers, and <a href="http://www.json.org/" rel="nofollow">www.json.org</a> provides a long list of JSON parsers for various different languages. The JS versions will fall back on the native implementation for speed.</p> <p>What all this means is that there's <strong>no good reason</strong> to use <code>eval</code> for JSON parsing.</p>