javascript

Parsing JSON
CHAPTER 10 ■ SCRIPTING BOM
More and more, XML is being supplanted by JSON, a data exchange format derived from JavaScript
object and array literal syntax. JSON downloads snappy and is simple to parse. Just pass JSON data to
window.eval(), and you have a JavaScript array or object. However, passing third-party JSON data, which
may be malformed or malicious, to eval() is a horrible idea.
■ Caution The eval() method is a powerful and dangerous tool. You should not pass any third-party data to it,
because that third-party data could well contain malicious code for your users’ browsers to run. This could lead to
all sorts of attacks and discomforts.
For this reason, Internet Explorer 8, Firefox 3.5, and Safari 4 define a method, JSON.parse(), for you
to use instead of eval(). For other versions and browsers, download the free JSON parser maintained by
Douglas Crockford, JSON’s creator, from http://json.org/json2.js. Delete the first line:
alert('IMPORTANT: Remove this line from json2.js before deployment.');
Save the file as json2.js to the same directory as your other JavaScript files. Then link it in to your
XHTML page. json2.js will define window.JSON only if it is missing. So for ten.html, we would link in
json2.js like so:
Getting StartED with JavaScript
Running
adidas
ASICS
Brooks
New
Balance
Nike
Saucony
441