Question

It’s not about eval()

Let say I have #password input, and I send this data as a part of JSON object

var toSend = {
    text: 'hello',
    pass: $("#password").val()
};

Do I need to validate input?
Would ", you: "are hacked" be interpreted on another side of communication as single string or empty string and another property?

edit: Nothing would happen in browser environment, but if JSON would be sent over internet as plain text and parsed again?

Answer 1

If you would do the thing you’re describing, nothing would happen, as json is being escaped (if you’re using parser (JS object -> JSON))

Nothing would happen in browser environment, but if JSON would be sent over internet as plain text and parsed again?

If you’re parsing string version (JSON) to JS object, all values are unesecaped, so you have to escape them afterwards.