json_encode adding too many double quotes - php

Question

I am working on a PHP web service that returns data in JSON form. I am at a point where I am now testing the web service with a jQuery/javascript file. It seems to be making the calls and receiving data correctly but the return values from the server seem to have too many double quotes.
PHP:
public static function getToken($username, $password)
{
$token = AuthenticationController::authenticate($username, $password);
if ($token)
{
$user = AuthenticationController::getUserFromToken($token);
if (UserController::userIsVerified($user->id))
{
$t = array('token' => $token);
return json_encode($t);
}
return json_encode(array('error' => 'This account has not been verified. Check email and click the provided link to verify the account.'));
}
return json_encode(array('error' => 'Authentication failed.'));
}
JS:
req.done(function(msg)
{
if (msg.error)
{
error = true;
message = msg.error;
}
else if (msg.message)
{
message = msg.message;
}
else if (msg.token)
{
token = msg.token;
}
else
{
error = true;
message = "An unknown error has occured.";
}
});
For one, the msg object is not coming back as a JSON object but instead it comes in as a string, so I have to do a $.parseJSON(msg) on it. What you see below, the token variable ends up writing out to be "mylongtoken" (quotes included). And if you look at that variable in firebug, it is like this: ""mylongtoken"". Is this just default behavior and I need to strip the quotes out?

Answer 1

First, to enable jquery to parse your response as json, you must return an appropriate content type. application/json seems appropriate.
For added security, you can add X-Content-Type-Options: nosniff to prevent browsers that get tricked into reading your JSON as a normal page to try any content sniffing which might enable HTML parsing and XSS:
Second, If you get two sets of quotes, then something you coded does add them. json_encode() does not:
echo json_encode(array('token' => 'tokenstring'); will output {"token":"tokenstring"} - no surrounding quotes. Any quotes inside any strings will be escaped using a backslash.