Question

Consider this my json string,

[{
  "Mat_id": "2",
  "Mat_Name": "Steel",
  "Measurement": "mm",
  "Description": "Steel"
}]

Can i add HTML Tags inside this json string like this,

[{
  "Mat_id": "2",
  "Mat_Name": "Steel",
  "Measurement": "<bold>mm</bold>",
  "Description": "Steel"
}]

• Whether this is a valid json string?
• When Eval(‘(‘+ thisstring +’)’) will raise an issue? If so what is it?

I am doing so because i will pass this json object to a yui datatable which consumes json
datasource…

EDIT:

This my resulted json string,

{
  "Table": [{
    "Mat_id": "2",
    "Mat_Name": "Jully",
    "Measurement": "<bold>Inches</bold>",
    "Description": "Gully"
  }, ]
}

But i didnt get my Measurement column values in bold…

Answer 1

Technically, yes, you can do that… practically, I’d be a bit concerned if there were HTML markup in my data. What else might be in there? Smells like an XSS vulnerability.