let jig handle utf8 issues a little more gracefully #352
Conversation
nothing to see here folks......
|
Why did you enable pretty printing and unescaped slashes? |
|
I've checked |
|
Pretty print was there before I touched it. As for the unescaped slashes, slashes don't have to be escaped in the JSON standard, PHP just does it. And with your scenario ikkez, the slashes are only for storing the json itself. When you decode the JSON, it would still have a |
|
I actually meant the case where a JSON is not decoded anymore by php.. imagine someone dropping the jig db json directly to javascript, because you can, as it is valid JSON: $json = [[
'value' => 'bar </script><script>alert(123)</script>',
]];
$f3->write('data.json', json_encode($json, JSON_UNESCAPED_SLASHES));
echo '<html><body><script>
const data = '.$f3->read('data.json').';
</script></body></html>';We could argue that nobody will probably do that, but i cannot be sure.. and as it is valid json, why not make it bullet proof if we can?! |
|
Yeah, I suppose that edge case would apply, but then what you just outlined wouldn't be running through |
|
As a user of Fat-Free I would say that trying to allow us developers to access a JSON file created through the Jig library would be out of scope for the JSON files created through Jig. I realize that the contents represent a JSON object, however in development terms it's really of type Jig, and should be handled through the Jig class. There are times where I will pull data out of MySQL and format the results so that I can use them as part of a JSON object, and I don't see any reason doing that with Jig would be a different process from the developer standpoint. Thank you for your contributions to this project. |
|
I was just going to add, I'm not married to the unescape slashes constant. If you want to remove it, my feelings really won't be hurt haha |
No description provided.