title: Is this safe for providing JSONP?
body: <pre><code>&lt;?php header('content-type: application/json');
  
  $json = json_encode($data);
  
  echo isset($_GET['callback'])
      ? "{$_GET['callback']}($json)"
      : $json;
  </code></pre>
  
  <p>Or should I for example filter the <code>$_GET['callback']</code> variable so that it only contains a valid JavaScript function name? If so, what are valid JavaScript function names?</p>
  
  <p>Or is not filtering that variable a bit of the point with JSONP?</p>
  
  <hr>
  
  <p><strong>Current solution:</strong> Blogged about my current solution at <a href="http://www.geekality.net/?p=1021" rel="noreferrer">http://www.geekality.net/?p=1021</a>. In short, for now, I have the following code, which hopefully should be pretty safe:</p>
  
  <pre><code>&lt;?php header('content-type: application/json; charset=utf-8');
  
  function is_valid_callback($subject)
  {
       $identifier_syntax
         = '/^[$_\p{L}][$_\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\x{200C}\x{200D}]*+$/u';
  
       $reserved_words = array('break', 'do', 'instanceof', 'typeof', 'case',
         'else', 'new', 'var', 'catch', 'finally', 'return', 'void', 'continue', 
         'for', 'switch', 'while', 'debugger', 'function', 'this', 'with', 
         'default', 'if', 'throw', 'delete', 'in', 'try', 'class', 'enum', 
         'extends', 'super', 'const', 'export', 'import', 'implements', 'let', 
         'private', 'public', 'yield', 'interface', 'package', 'protected', 
         'static', 'null', 'true', 'false');
  
       return preg_match($identifier_syntax, $subject)
           &amp;&amp; ! in_array(mb_strtolower($subject, 'UTF-8'), $reserved_words);
  }
  
  $data = array(1, 2, 3, 4, 5, 6, 7, 8, 9);
  $json = json_encode($data);
  
  # JSON if no callback
  if( ! isset($_GET['callback']))
       exit( $json );
  
  # JSONP if valid callback
  if(is_valid_callback($_GET['callback']))
       exit( "{$_GET['callback']}($json)" );
  
  # Otherwise, bad request
  header('Status: 400 Bad Request', true, 400);
  </code></pre>