title: Are there any injection vulnerabilities in JSON?
body: <p>It's not about <code>eval()</code></p>
  
  <p>Let say I have #password input, and I send this data as a part of JSON object</p>
  
  <pre><code>var toSend = {
      text: 'hello',
      pass: $("#password").val()
  };
  </code></pre>
  
  <p>Do I need to validate input?
  Would <code>", you: "are hacked"</code> be interpreted on another side of communication as single string or empty string and another property?</p>
  
  <p><strong>edit</strong>: Nothing would happen in browser environment, but if JSON would be sent over internet as plain text and parsed again?</p>