serializing web objects it is not good idea to load pickled object from an unknown or untrusted source it is possible to inject arbitrary code into pickled file to maliciously attack computer via the pickle another disadvantage of pickles is that they can only be loaded by other python programsand cannot be easily shared with services written in other languages there are many formats that have been used for this purpose over the years xml (extensible markup languageused to be very popularespecially with java developers yaml (yet another markup languageis another format that you may see referenced occasionally tabular data is frequently exchanged in the csv (comma separated valueformat many of these are fading into obscurity and there are many more that you will encounter over time python has solid standard or third-party libraries for all of them before using such libraries on untrusted datamake sure to investigate security concerns with each of them xml and yamlfor exampleboth have obscure features thatused maliciouslycan allow arbitrary commands to be executed on the host machine these features may not be turned off by default do your research javascript object notation (jsonis human readable format for exchanging primitive data json is standard format that can be interpreted by wide array of heterogeneous client systems hencejson is extremely useful for transmitting data between completely decoupled systems furtherjson does not have any support for executable codeonly data can be serializedthusit is more difficult to inject malicious statements into it because json can be easily interpreted by javascript enginesit is often used for transmitting data from web server to javascript-capable web browser if the web application serving the data is written in pythonit needs way to convert internal data into the json format there is module to do thispredictably named json this module provides similar interface to the pickle modulewith dumploaddumpsand loads functions the default calls to these functions are nearly identical to those in pickleso let us not repeat the details there are couple differencesobviouslythe output of these calls is valid json notationrather than pickled object in additionthe json functions operate on str objectsrather than bytes thereforewhen dumping to or loading from filewe need to create text files rather than binary ones