PHP : Injection JSON

Perhaps the introduction of malicious code in JSON.

JSON injection occurs when

• Data enters the program from untrusted source
• Data is transfered to a JSON stream

Usually, applications use JSON to store data and send messages. In the first case, JSON can be treated as cashed data, which means it can potentially contain sensitive information. In the second case, JSON is often used with the RESTful service (the service for transfering the presentation state) and can be used to transfer confidential information, such as credentials for authenticitication.

The semantics of documents can be changed as a result of the introduction of malicious code in JSON. In the least bad case, an attacker could simply insert extraneous elements into the code, which would be the reason for throwing exceptions. In the worst case, an attacker can manipulate elements, changes in which will be critical to security. In some cases, JSON injection can lead to cross-site scripting.