<?php header('content-type: application/json'); $json = json_encode($data); echo isset($_GET['callback'])     ? "{$_GET['callback']}($json)"     : $json;   Or should I for example filter the $_GET['callback']  variable so that it only contains a valid JavaScript function name? If so, what are valid JavaScript function names?   Or is not filtering that variable a bit of the point with JSONP?   Current solution:  Blogged about my current solution at http://www.geekality.net/?p=1021  . In short, for now, I have the following code, which hopefully should be pretty safe: <?php header('content-type: application/json; charset=utf-8'); function is_valid_callback($subject) {      $identifier_syntax        = '/^[$_\p{L}][$_\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\x{200C}\x{200D}]*+$/u';      $reserved_words = array('break', 'do', 'instanceof', 'typeof', 'case',        'else', 'new', '...