Proper way to escape json data in PHP without using JS comment hack

Question

Consider the code below to send a json string to js from php,

<?php
    $str = "<!--<script>"; // This is from user input
?>

<script>
   var json_str = <?= json_encode($str) ?>;
</script>

The string will break the HTML, and the way to solve it is via something like the old school comment hack, e.g.

<script>
<!--
   var json_str = <?= json_encode($str) ?>;
//-->
</script>

Are there any alternative?

The example shown will not result the expected way, anyway, if you need to escape it, you can use htmlentities — Ivan Yonkov
– Ivan Yonkov, Commented Aug 18, 2014 at 11:24
var str = <?= json_encode(strip_tags($str)); ?>; not an option? strip_tags, or even a simple str_replace(array('), '', $str)` should do — Elias Van Ootegem
– Elias Van Ootegem, Commented Aug 18, 2014 at 11:24

C3roe · Accepted Answer · 2014-08-18 11:49:38Z

5

You can use the flag JSON_HEX_TAG, so that < and > will be encoded as \u003C and \u003E respectively.

json_encode($str, JSON_HEX_TAG)

answered Aug 18, 2014 at 11:49

C3roe

97.6k15 gold badges100 silver badges172 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

+1 This is the best way - as per the OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet - Except for alphanumeric characters, escape all characters with the \uXXXX unicode escaping format (X = Integer)..