Question

I’m including JSON in an HTML tag, considering the only possible input characters for the JSON will be "':{},[a-z][0-9] is it possible for JSON or HTML to be broken with my approach? What should I be wary of when using JSON across HTML and Javascript?

<input type="hidden" value="<?=htmlspecialchars(json_encode($myArray));?>" />

Answer 1

JSON can contain nearly any character in its strings. As you are using it in an attribute, escape_quotesaddslashes should be enough, that depends on your (X)HTML version. htmlspecialchars is OK anyway.