All 7 JSON Handling in PHP questions
More in JSON Handling in PHP
How do you convert a PHP array or object into a JSON formatted string using json_encode? How do you convert a JSON formatted string back into a PHP array or object using json_decode? How do you properly handle errors when parsing potentially invalid JSON, and how does the JSON_THROW_ON_ERROR flag simplify this compared to manually checking json_last_error? How do you control the depth and formatting of json_encode output, such as pretty printing JSON for readability or handling deeply nested data structures? How should an API validate the structure and types of incoming JSON data to ensure it matches the expected schema before processing it further? What performance considerations arise when working with very large JSON payloads in PHP, and how do streaming JSON parsers help address them?
Advertisement
Back to results for “Security”
PHP › JSON Handling in PHP

How can PHP objects implementing the JsonSerializable interface customize exactly how they are converted into JSON when passed to json_encode?

Intermediate

Answer

The JsonSerializable interface requires implementing a single method, jsonSerialize, which returns the exact data structure that should actually be used when json_encode processes an instance of that class, letting you control precisely what gets included in the resulting JSON, such as excluding a sensitive password property or renaming certain fields, rather than json_encode simply dumping every public property of the object by default.
class User implements JsonSerializable {
    public function __construct(private string $name, private string $password) {}
    public function jsonSerialize(): mixed {
        return ['name' => $this->name];
    }
}
echo json_encode(new User('Ali', 'secret123'));
Real-world example A User class implements JsonSerializable to explicitly exclude the password property from ever appearing in JSON output, providing a strong guarantee against accidentally leaking sensitive data through an API response regardless of how that object gets encoded.

Common follow-ups: What happens to a class's private and protected properties when json_encode processes it without JsonSerializable implemented?;How does this interface compare to using a dedicated data transfer object specifically for API responses?

OOP;Security
All 7 JSON Handling in PHP questions