New format
JSON: what it is, how to open it, and where it’s used
JSON (JavaScript Object Notation) is a text format for exchanging structured data between programs and languages. It grew out of the JavaScript world, but it doesn’t depend on JS: Python, PHP, Go, mobile apps, and APIs all read it.
Below: why JSON shows up on sites, how the syntax works, how to open a file, and why you must never feed a foreign response into `eval`. Old IE version lists and outdated editors are skipped as noise.
Where JSON is used
Web classic: the browser requests data from the server (Ajax / `fetch`), gets JSON, and updates the page without a full reload — feed, catalog, cart, dashboard.
Also: REST/GraphQL responses, front-end configs, local settings storage, and exchange between microservices and a mobile client.
Typical scenarios:
- site and mobile app APIs
- loading blocks without a full reload
- exports and integrations
- dev-tool configs
Syntax: objects and arrays
Two building blocks: object `{ "key": value }` and array `[ value1, value2 ]`. Object keys are quoted strings. Values: string, number, `true`/`false`, `null`, nested object or array.
Store phones and leading zeros as strings: `"84959000000"`, not numbers — or you lose the format. Strict JSON does not allow a trailing comma after the last element.
Spaces and line breaks help humans; over the wire you often send a compact one-liner — same meaning.
Common beginner mistakes:
- single quotes instead of double
- a comma after the last field
- `//` comments in strict JSON
- numbers where a string is needed (phone, SKU)
Ajax, APIs, and security
The client requests a URL; the server responds with a JSON body and a header like `Content-Type: application/json`. In modern JS, `fetch` + `response.json()` is enough — no `eval`.
Historical same-origin workarounds (JSONP, injecting `<script>`) widened the attack surface. For new projects use CORS and plain JSON over HTTPS.
Never execute foreign JSON as code. Parse with a built-in parser and validate fields on the server if data goes into a DB or affects permissions.
Security rules:
- only `JSON.parse` / the language equivalent
- don’t trust client fields without checks
- HTTPS for sensitive responses
- don’t put secrets in public front-end JSON
How to open and edit .json
The file is plain UTF-8 text. VS Code, Cursor, Notepad++, Sublime, or a system text editor is enough. IDEs highlight brackets and flag syntax errors.
Heavy all-in-one tools like old XML editors aren’t required. For a quick check, use the editor’s formatter and online validators — don’t paste production secrets there.
Practical minimum:
- an editor with JSON highlighting
- pretty-print for reading
- validation before shipping a feed or config
- diff in git, not blind edits on the server
FAQ
Is JSON a programming language?
No. It’s a data format: objects, arrays, strings, numbers, booleans, null. You don’t write programs in it — you exchange data with it.
How is it different from XML?
Usually more compact and simpler for JS/APIs. XML is stronger with schemas and mixed markup. For web APIs today, JSON is more common.
How do I open a .json file?
Any text editor or IDE with highlighting. In a browser — an extension/viewer or paste into an online validator. For production work, prefer an editor with a formatter.
Can I parse JSON with eval?
Not in real projects. Use `JSON.parse` or the language’s built-in parsers. `eval` executes code and opens XSS/injection risk.
What is JSON5?
An extension with comments and looser syntax. Handy in human-edited configs; for API exchange you usually stay with strict JSON.
API payloads breaking on commas, quotes, or risky eval parsing?
We’ll lock strict JSON syntax, safe parse paths, and clean configs for front and integrations.
Discuss the task
