While I generally agree with your sentiment, I was merely writing a brief proof of concept test in the firebug console. From: http://www.json.org/js.html http:

While I generally agree with your sentiment, I was merely writing a brief proof of concept test in the firebug console. From: http://www.json.org/js.html http://www.json.org/js.html "The use of eval is indicated when the source is trusted and competent. It is much safer to use a JSON parser." FB is still using eval() if you look at their code. As the source of the JSON is their own service, and they can, therefore, trust it assuming proper sanitization; the same applies for my test case.