#41307 [NEW]: Extend json_encode to support XSS-safe output

From: marcus at synchromedia dot co dot uk Operating system: n/a PHP version: 5.2.2 PHP Bug Type: Feature/Change Request Bug description: Extend json_encode to support XSS-safe output Description: ------------ It would be nice to add a json safety feature to prevent XSS attacks. There is already a popular implementation of the client end of this, which is described here: http://www.prototypejs.org/learn/json My request is to add an optional param to json_encode so that it produces output which is compatible with that of prototype. Any other JS library will still be compatible wih that approach. In short, wrap json_encode output in comments like so: $json_output = "/*-secure-\n".json_encode($myvar)."*/"; A new implementation might achieve this as: $json_output = json_encode($myvar, true); I'm suggesting doing this in the ext rather than in user code as it's something that will likely be used a lot, and the syntax is easy to get wrong. -- Edit bug report at http://bugs.php.net/?id=41307&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41307&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41307&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41307&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41307&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41307&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41307&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41307&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41307&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41307&r=support Expected behavior: http://bugs.php.net/fix.php?id=41307&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41307&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41307&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41307&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41307&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41307&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41307&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41307&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41307&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41307&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41307&r=mysqlcfg