JSON has been relevant since its adoption in popular Web services in the mid-2000s. XML is older, having been around since 1998, when the World Wide Web Consortium (W3C) officially recommended it.XML and JSON are both universal formats for sharing data between architectures and computer programs, but they have a number of differences. It is first important to summarize what XML and JSON have in common:
Both are widely used data sharing standards, with publicly available documentation:
Both are self-descriptive and human readable: self-descriptive in that they are represented as a hierarchical tree of metadata, and human readable in that the data itself is ASCII and Unicode characters;
There are libraries to work with both for many programming languages: including JavaScript, Python, Perl, Ruby and others;;
Client JavaScript code can access responses in either language through asynchronous requests.
XML
The configuration of XML parsers and their interaction with the document structure involves a number of security issues that must be addressed to adequately protect an application using XMLs.
JSON
Being a simple data format with no document-based configurations, simple parsing of a JSON document is not prone to misconfiguration. However, since JSON was designed to be a subset of JavaScript, it is tempting to parse a JSON document by simply passing it to a JavaScript engine (e.g., the eval method). Some implementations of JSON exchanges in JavaScript work this way and can open an application to known vulnerabilities.