json_decode()

Also Known As

TL;DR

Explanation

json_decode($json, true) parses a JSON string, returning an associative array (true) or stdClass object (false/null). Unlike unserialize(), it cannot instantiate arbitrary PHP objects or invoke magic methods, making it safe for untrusted input. Always check json_last_error() === JSON_ERROR_NONE after decoding, or use JSON_THROW_ON_ERROR (PHP 7.3+) to throw a JsonException on malformed input. Use json_encode() with JSON_THROW_ON_ERROR on the output side.

Common Misconception

Why It Matters

Common Mistakes

• Not checking json_last_error() after decoding — null from a malformed JSON string is indistinguishable from JSON null.
• Using the second argument (assoc=true) inconsistently — mixing object and array access patterns.
• Not setting JSON_THROW_ON_ERROR flag (PHP 7.3+) — eliminates the need to manually check json_last_error().
• Not validating the decoded structure — a valid JSON string may decode to a type or shape the application does not expect.

Code Examples

// Silent failure on invalid JSON:
$data = json_decode($input);
$name = $data->name; // Fatal error or null — json_last_error() not checked

// Safe:
$data = json_decode($input, flags: JSON_THROW_ON_ERROR);
// JsonException thrown on invalid JSON

// Always pass true for associative array (avoids stdClass)
$data = json_decode($json, true);

// Check for errors
if (json_last_error() !== JSON_ERROR_NONE) {
    throw new \InvalidArgumentException('Invalid JSON: ' . json_last_error_msg());
}

// PHP 7.3+ — throw on error
try {
    $data = json_decode($json, true, 512, JSON_THROW_ON_ERROR);
} catch (\JsonException $e) {
    throw new \InvalidArgumentException('Invalid JSON', previous: $e);
}

// Encode with useful flags
$json = json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);

References

• ↗ https://www.php.net/manual/en/function.json-decode.php

Tags

Related Terms