Keep in mind that json2.js' JSON.parse() ultimately uses eval() after a few sanity checks. Definitely better than a blind eval(), but not quite the panacea it's often purported to be.