json_validate() — Native JSON Validation (PHP 8.3)

Also Known As

TL;DR

Explanation

Before PHP 8.3, the only way to validate JSON was to call json_decode() and check json_last_error() — which allocated memory to build the decoded value even though you only wanted to know if the string was valid. json_validate() parses the JSON structure without building a PHP data structure, making it significantly faster and less memory-intensive for large payloads. It returns true/false. It accepts the same optional depth and flags arguments as json_decode(). This is ideal for webhook handlers, API input validation, and message queue consumers that need to validate incoming JSON before forwarding to a decoder.

Common Misconception

Why It Matters

Common Mistakes

• Calling json_validate() and then immediately calling json_decode() on failure — json_validate() returns false on invalid JSON, so the decode should only happen in the true branch.
• Using json_validate() as a substitute for schema validation — it only checks JSON syntax, not whether the structure matches your expected schema.
• Not specifying a depth limit for untrusted input — deeply nested JSON can cause stack overflows; json_validate($input, depth: 10) is safer for external data.
• Forgetting JSON_THROW_ON_ERROR on json_decode() after validation — json_decode() can still return null for valid JSON ('null' is valid JSON), so throw-on-error prevents silent failures.

Code Examples

<?php
// ❌ Using json_decode() purely for validation — wasteful
function handleWebhook(string $body): void
{
    $data = json_decode($body, true); // Allocates full PHP array
    if (json_last_error() !== JSON_ERROR_NONE) {
        throw new InvalidArgumentException('Invalid JSON');
    }
    // Now decode again (or use $data — but you allocated it twice if validating first)
    processPayload($data);
}

<?php
// ✅ PHP 8.3 — validate cheaply, decode only once
function handleWebhook(string $body): void
{
    if (!json_validate($body)) {
        throw new InvalidArgumentException('Invalid JSON payload');
    }
    // Decode only after confirming validity
    $data = json_decode($body, true, 512, JSON_THROW_ON_ERROR);
    processPayload($data);
}

// With depth limit for untrusted input
if (!json_validate($untrustedInput, depth: 5)) {
    return false;
}

References

• ↗ https://www.php.net/json_validate
• ↗ https://wiki.php.net/rfc/json_validate

Tags

Related Terms