The only reason JSON script injection is a problem is because nitwits don't use a library that parses the JSON code first to verify that it's 100% pure JSON. Cr

The only reason JSON script injection is a problem is because nitwits don't use a library that parses the JSON code first to verify that it's 100% pure JSON. Crocker's JSON library fully verifies pure JSON-ness before eval-ing the string (which is technically an unnecessary step). Furthermore, why should we worry about changing JSON? It's not amazingly difficult to construct a parser for some custom document format like this, after all. I use a subset of Ruby as a data interchange format because of the ability to use arbitrary values as hash keys, and the ability to have symbols that are distinct from strings. The parser for it is maybe 80 lines at most, and doesn't rely on Ruby internals to handle it. Because Ruby also doesn't have a Date/Time literal notation, I have a way of denoting that (datetime(...)) which the parser also handles. There's no reason people should be talking about this, it's a non-issue. It's never too late to change JSON, or to even do something completely different that better suits your needs. Just write the parser for it! And if the issue is "OMG interoperability! :(", it's not terribly diffuclt to provide your developers with the JavaScript lib to handle the parsing.