134

per the debate in this post: json-conversion-in-javascript

Community
  • 1
  • 1
Dustin Getz
  • 21,282
  • 15
  • 82
  • 131

6 Answers6

165

Yes, an array is legal as top-level JSON-text.

There are four standard documents defining JSON: RFC 4627, RFC 7159 (which obsoletes RFC 4627), ECMA-404, and RFC 8259 (which obsoletes RFC 7159, and calls ECMA-404 normative). They differ in which top-level elements they allow, but all allow an object or an array as the top-level element.

  • RFC 4627: Object or array.
    "A JSON text is a serialized object or array."
  • RFC 7159, RFC8259: Any JSON value.
    "A JSON text is a serialized value. Note that certain previous specifications of JSON constrained a JSON text to be an object or an array." Section 2
  • ECMA-404: Any JSON value.
    "A JSON text is a sequence of tokens formed from Unicode code points that conforms to the JSON value grammar."
Chris F Carroll
  • 11,146
  • 3
  • 53
  • 61
Dustin Getz
  • 21,282
  • 15
  • 82
  • 131
  • 3
    As of [this newer RFC](http://www.ietf.org/rfc/rfc7159.txt), "A JSON text is a sequence of tokens. The set of tokens includes six structural characters, strings, numbers, and three literal names." – antak Mar 10 '16 at 11:34
  • 1
    @antak What does this mean in relation to the question? – Orestis Kapar Feb 18 '21 at 18:06
  • 1
    @OrestesKappa The comment is commentary on the answer and not the question, but it's spirit is now reflected in the current revision of this answer. Succinctly: The newer RFC does not limit JSON text to an object or an array and any serialized value is allowed. – antak Feb 19 '21 at 08:38
  • Does the term "JSON text" refer to the top-level object? It's not clear to me. – ryanwebjackson Apr 14 '22 at 14:43
71

Yes, but you should consider making the root an object instead in some scenarios, due to JSON hijacking. This is an information disclosure vulnerability based on overriding the array constructor in JavaScript.

Matthew Flaschen
  • 278,309
  • 50
  • 514
  • 539
  • 12
    FWIW, JSON hijacking [is not an issue for modern browsers](http://stackoverflow.com/questions/16289894/is-json-hijacking-still-an-issue-in-modern-browsers). – Franklin Yu Oct 01 '16 at 19:38
5

This is from the ECMAScript specification.

JSONText :
    JSONValue

JSONValue :
    JSONNullLiteral 
    JSONBooleanLiteral 
    JSONObject 
    JSONArray 
    JSONString 
    JSONNumber
ChaosPandion
  • 77,506
  • 18
  • 119
  • 157
  • 3
    This is a little misleading, though, because ECMAScript allows you to parse JSON strings that are not top-level texts. According to the RFC, "A JSON text is a serialized object or array." – Matthew Flaschen Sep 30 '10 at 17:55
  • @Matthew - Weird, I wonder how Crockford feels about that. How will they reconcile the differences between the RFC and ECMA? – ChaosPandion Sep 30 '10 at 17:59
  • 5
    I just looked, and found they're aware of the difference. From ECMAScript 5 §15.12, "The top level JSONText production of the ECMAScript JSON grammar may consist of any JSONValue rather than being restricted to being a JSONObject or a JSONArray as specified by RFC 4627." I don't know if IETF will change the RFC. – Matthew Flaschen Sep 30 '10 at 18:06
  • @Matthew - Thanks for that, I was getting horribly confused. The json.org description doesn't mention the more restrictive concept of "json-text" *at all*, and the RFC's kind of vague about its significance. – mrec Feb 15 '13 at 17:46
  • This answer is about ECMAScript, but the question is about JSON. While they (deliberately) look similar, they are _different specs_. – sleske Apr 01 '16 at 13:32
4

Yes you can do it. Put in [{}]

Machavity
  • 30,841
  • 27
  • 92
  • 100
hvgotcodes
  • 118,147
  • 33
  • 203
  • 236
3

This works for me:

["apple","pear","banana"]

I store that above in MySQL DB as a string, and then have no problem doing this in my PHP:

  <?php

        $checkArr = json_decode($pageData[0]['pg_json']);

        echo $checkArr[0];

    ?>

Which yields this:

apple

WebDev-SysAdmin
  • 269
  • 4
  • 12
2

There is some confusion, seen in the other comments. The "application/json" media type allows only object or array at the top-level for JSON-text, per JSON RFC. However, for a parser any JSON value is acceptable, as seen in the ECMAScript specification.

Update: RFC 4627 is outdated. The new RFC 7159 permits also simple values at the top-level. (Thanks, Matthias Dieter Wallnöfer.)

cdunn2001
  • 17,657
  • 8
  • 55
  • 45
  • Any JSON value as the top-level element is acceptable for an _ECMAScript parser_, but not for a (compliant) _JSON parser_ - important distinction. – sleske Apr 01 '16 at 13:34
  • That's an interesting distinction, but I don't understand what you're saying. What is the definition of a "(compliant) JSON parser"? – cdunn2001 Apr 09 '16 at 17:55
  • 2
    Well, a JSON parser is a parser for the JSON grammar. While JSON looks similar to Javascript, it is a different (much simpler) grammar. See https://tools.ietf.org/html/rfc7159 , which describes the JSON grammar. "compliant" just means the parser actually follows the grammar (which any decent parser should). – sleske Apr 09 '16 at 22:11
  • 6
    RFC 4627 is outdated, please don't follow it any longer. The new RFC permits also simple values at the top-level. – Matthias Dieter Wallnöfer Jun 30 '17 at 07:28
  • 1
    For future readers, the newer standard is [RFC 7159](https://www.rfc-editor.org/rfc/rfc7159). – Leon Adler Oct 09 '22 at 14:29