PHP JSON

PHP JSON: Encoding API Responses and Decoding Payloads

JSON (JavaScript Object Notation) is the standard text format for REST APIs, webhooks, and configuration files. PHP includes json_encode() and json_decode() out of the box, letting you convert cleanly between PHP arrays, objects, and JSON strings.

Encoding PHP Data with json_encode()

Pass JSON_THROW_ON_ERROR so encoding issues (like malformed UTF-8 strings) throw a clear JsonException instead of silently returning false. For HTTP APIs, always send header('Content-Type: application/json; charset=utf-8'); before printing the JSON string.

<?php
declare(strict_types=1);

$payload = [
    'status' => 'ok',
    'lesson' => [
        'slug' => 'php-json',
        'tags' => ['php', 'api', 'json'],
    ],
];

$json = json_encode($payload, JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES);
echo $json . PHP_EOL;

Decoding JSON Safely with json_decode()

Pass true as the second argument (associative: true) when you want JSON objects decoded into PHP associative arrays instead of stdClass objects. Always wrap decoding in a try / catch (JsonException $e) block when reading external request bodies.

<?php
declare(strict_types=1);

$rawBody = '{"user":"amina","credits":150}';

try {
    $data = json_decode($rawBody, associative: true, flags: JSON_THROW_ON_ERROR);
    echo "User: {$data['user']}, Credits: {$data['credits']}" . PHP_EOL;
} catch (JsonException $e) {
    echo "Invalid JSON payload: " . $e->getMessage() . PHP_EOL;
}

Note how json_encode([1 => 'a', 2 => 'b']) outputs a JSON object {"1":"a","2":"b"} because the numeric keys do not start at 0. Call array_values() after array_filter() whenever you expect a JSON array [...].

Common Mistakes to Avoid

• Ignoring json_decode() errors: Without JSON_THROW_ON_ERROR, invalid JSON returns null silently, which looks identical to decoding "null".
• Forgetting array_values() on filtered lists: Filtering [10, 20, 30] removes index 0 and leaves keys [1, 2], turning a JSON array into a JSON object.
• Decoding huge JSON payloads without depth limits: Keep the default depth (512) or lower it when accepting untrusted webhook bodies to block deeply nested memory attacks.

Frequently Asked Questions

What does JsonSerializable do on a PHP class?

Implementing JsonSerializable and its jsonSerialize(): mixed method lets a class control the exact array or properties returned when passed to json_encode().

Why does json_encode([]) produce [] instead of {}?

PHP cannot distinguish an empty list from an empty map. Use (object) [] or JSON_FORCE_OBJECT when an API requires {}.

How do I read a JSON POST body in PHP?

Read the raw request stream using file_get_contents('php://input') and pass it to json_decode().