Is it safe to send the unencoded JSON output? The mobile app developers wants an api to get a list of articles from our Drupal site.
It should have these fields in the output:


nid
title
field_teaser_body


The api resonse has to be in JSON format.

The field type of field_teaser_body field is Long text and text processing is Plain text.

I created a custom code to get this working. Here's a simplified version of it.

$query = db_select('node', 'n');

$query
  -&gt;fields('n', array('nid', 'title'))
  -&gt;condition('n.status', 1)
  -&gt;orderBy('n.created', 'DESC')

$result = $query-&gt;execute();

$nodes = array();
foreach ($result as $value) {
  $node = node_load($value-&gt;nid);

  $data = array(
    'nid' =&gt; $node-&gt;nid,
    'title' =&gt; $node-&gt;title,
    'field_teaser_body' =&gt; !empty($node-&gt;field_teaser_body['und'][0]['value']) ? check_plain($node-&gt;field_teaser_body['und'][0]['value']) : '',
  );

  $data = (object) $data;
  array_push($nodes, $data);
}

$content = new stdClass();
$content-&gt;nodes = $nodes;

print json_encode($content);


Just for the security purpose, I'm using check_plain() function to sanitize the teaser body text. But, when using this function, it encodes all special characters.

For e.g.,
Bob's height is &gt; than Alice.
converts to
Bob&amp;#039;s height is &amp;gt; than Alice.

The mobile app developers said that they don't want any encoded text in the JSON output.

Is it a safe practice to send the unencoded (unsanitized) text in the JSON output ?
There is no need to encode or escape anything yourself. json_encode() will take care of properly escaping any special purpose characters.