Comments on: JSON vs XML

By: Bala Anil

Bala Anil — Tue, 18 Nov 2008 19:15:57 +0000

Very nice article.
But I don’t agree in one of those points that you discussed is Ease of Data Processing on the Client Side. If you use IE, DOM is very powerful for XML data reading.

var xml = xhr.responseXML;
var elements = xml.selectSingleNode(”person/firstName”)
// This is excellent if you have even more nested childs
alert(elements.innerHTML);

One more difference between them is nested data. XML is the best to deal with the nested data.

By: Sudhir

Sudhir — Fri, 27 Jun 2008 05:10:14 +0000

Nice article,
I like JSON because of its ease of processing on the client side.

By: Dutt

Dutt — Fri, 16 Nov 2007 01:28:59 +0000

Thanks for the post, very nice one, I shall share this to my friends.

By: Subbu Allamaraju

Subbu Allamaraju — Thu, 23 Aug 2007 13:00:49 +0000

Thanks for the comment. Fixed the typo.

By: dreamwind

dreamwind — Thu, 23 Aug 2007 12:55:15 +0000

There is a typo in link for QuirksMode.org

Thank you for article

By: Oren

Oren — Thu, 24 May 2007 19:51:38 +0000

I agree, I even think that working with JSON is much more easier on server side than working with XML on the client.

Thanks, your post was very helpful that I summarized it on our blog.

By: phil

phil — Wed, 24 Jan 2007 23:25:57 +0000

Room for both technologies IMHO. Our industry does seem to have a penchant for religious fervor where technology selection is concerned.

By: Subbu Allamaraju

Subbu Allamaraju — Thu, 21 Sep 2006 13:27:25 +0000

In Response to Tim Lesher's comment...

I agree with your comment. It is not valid JSON at the format level. My intent was just to illustrate the point that you can inject code like this. In the absense of a method like responseObject on XMLHttpRequest, eval is the most common means of parsing JSON, and so one can include script in it.

By: Tim Lesher

Tim Lesher — Thu, 21 Sep 2006 11:48:04 +0000

There is another kind of extensibility possible with JSON, that is to inject code along with the data into the response.

Actually, the example you gave is not valid JSON. Per the JSON spec (RFC 4627), JSON elements must be either an object (defined as a {} pair), array, number, string, true, false, or null. alert is none of the above.

JSON is not JavaScript--it's a restricted subset of JavaScript, so it's an error (and a nice security hole) to use JavaScript's eval() to parse it. The right way to parse it is with a real JSON parser (like the JavaScript-based one at json.org).

By: Andres Almiray

Andres Almiray — Tue, 05 Sep 2006 16:13:05 +0000

I’m glad you mentioned Json-lib =)