PHP json_validate() Function

PHP json_validate() checks whether a string contains syntactically valid JSON. It returns true or false without creating the PHP array or object that json_decode() would normally build.

The function is available in PHP 8.3 and later. Use it when you only need to accept or reject JSON, such as validating a stored document, checking a message before forwarding it, or filtering uploaded data. It validates JSON syntax, not the meaning or required structure of the data.

How json_validate() Works

json_validate() parses the supplied string according to JSON rules. Valid numbers, strings, arrays, objects, booleans, and null pass the check. Trailing commas, single-quoted strings, comments, malformed escapes, and invalid nesting fail.

json_validate() Syntax

Syntax:

<?php
// Validate JSON with the default nesting depth.
$isValid = json_validate($json, 512, 0);

• json is the UTF-8 JSON string to check.
• depth sets the maximum nesting depth. The default is 512.
• flags changes supported validation behavior. PHP currently accepts JSON_INVALID_UTF8_IGNORE for this function.

A depth outside the allowed range raises ValueError. An unsupported flag also raises ValueError.

Validate JSON Syntax

The next example checks one valid payload and one payload with a trailing comma.

Example:

<?php
$payloads = [
    '{"name":"Asha","active":true}',
    '{"name":"Noah",}',
];

foreach ($payloads as $index => $payload) {
    // Validate syntax without building a PHP array or object.
    if (json_validate($payload)) {
        echo "Payload " . ($index + 1) . ": valid\n";
    } else {
        echo "Payload " . ($index + 1) . ": " . json_last_error_msg() . "\n";
    }
}

Output:

Payload 1: valid
Payload 2: Syntax error

Read the Validation Error

json_validate() returns only a boolean. After a false result, call json_last_error() or json_last_error_msg() immediately to inspect the most recent JSON error.

Example:

<?php
$json = '{"city":"London","codes":[10,20,]}';

if (!json_validate($json)) {
    // Read the error before another JSON operation changes it.
    echo json_last_error_msg();
}

Output:

Syntax error

Note: Error messages help diagnose syntax, but they do not provide a complete JSON Schema validation report.

Validation Does Not Check a Schema

A string may contain valid JSON while still missing fields that your application requires. After syntax validation, inspect decoded values or use a JSON Schema validator when you must enforce names, types, formats, ranges, or relationships.

Example:

<?php
$json = '{"name":"Emily"}';

// The JSON is valid even though the application expects an email field.
var_export(json_validate($json));

Output:

true

Avoid Parsing the Same JSON Twice

If you need the decoded data, call json_decode() directly with JSON_THROW_ON_ERROR. Calling json_validate() first and json_decode() second parses the same input twice and wastes work.

Example:

<?php
$json = '{"order":2048,"total":1499.50}';

try {
    // Decode once and receive an exception for invalid JSON.
    $order = json_decode($json, true, 512, JSON_THROW_ON_ERROR);
    echo $order['order'];
} catch (JsonException $error) {
    echo "Invalid JSON: " . $error->getMessage();
}

Use json_validate() instead when the boolean result is the final goal and decoded data would consume unnecessary memory.

Handle Invalid UTF-8

JSON strings must use UTF-8. By default, malformed UTF-8 causes validation to fail. The JSON_INVALID_UTF8_IGNORE flag tells PHP to ignore invalid byte sequences during validation.

Example:

<?php
$json = "{"label":"Broken \xB1 byte"}";

// Ignore malformed UTF-8 only when your data policy allows it.
$isValid = json_validate($json, 512, JSON_INVALID_UTF8_IGNORE);
var_export($isValid);

Ignoring invalid bytes can change text. Prefer fixing the source encoding when the exact value matters.

Validate External JSON Safely

• Set an input-size limit before validation to protect memory and request time.
• Choose a reasonable depth for the expected document shape.
• Check authorization and content rules separately from JSON syntax.
• Do not treat a true result as proof that the data is safe for SQL, HTML, or shell commands.

Conclusion

json_validate() offers a clear, memory-conscious syntax check when your application does not need decoded JSON. It returns a boolean, exposes parser errors through the existing JSON error functions, and supports depth and UTF-8 controls. Use json_decode() with exceptions when you need the data, and add schema or business validation when valid syntax alone is not enough.