6 ms·
If you have untrusted input, XML has it's own issues [1]. > JSON is fundamentally a dump of a data structure, not a document format. Exactly! IMHO, it's unfo
by Mindless2112 13y ago
If you have untrusted input, XML has it's own issues [1].
> JSON is fundamentally a dump of a data structure, not a document format.
Exactly! IMHO, it's unfortunate that mark-up documents can be used to represent other data structures. It isn't what they're meant for, and there are (or "should be" if you're not fond of JSON) better tools for human-readable serialization.
[1] http://en.wikipedia.org/wiki/Billion_laughs http://en.wikipedia.org/wiki/Billion_laughs
- zanny 13y agoYou mean yaml?
- Mindless2112 13y agoIndeed, YAML is a more powerful serialization format than JSON. The original name (Yet Another Markup Language) threw me off, so I never seriously considered using it. Even its Wikipedia article is in the "Markup languages" category.
- deleted 13y ago[deleted]
- zdw 13y agoMy general guidance is: Yaml for configuration files/things people touch XML for documents that are complex/nested, that need extra validation, or need to be stored for longer than a few days JSON for ephemeral data structures passed between two controlled endpoints
- zdw 13y agoIMO, if you're schema design would pass a Billion laughs style attack as being a valid file, you're probably doing something wrong. SAX style streaming/pull parsers tend to deal better with this kind of thing as well.