json_decode(): Comments and Trailing Commas in JSON

json_decode() only accepts strict JSON, so a comment or a comma after the last item is a syntax error. That's a problem for config files people edit by hand, like tsconfig.json or VS Code's settings.json, which often have both. PHP tools that read them strip the comments first, with a library or a regular expression.

Otar Chekurishvili's RFC adds two flags that let json_decode() and json_validate() accept comments and trailing commas. If you don't pass the flags, nothing changes.

What it looks like#

$config = <<<'JSON'
{
    // Connection for local development
    "host": "localhost",
    "port": 5432, /* default PostgreSQL port */
    "options": [
        "persistent",
        "utf8",
    ],
}
JSON;

// Before: strict JSON only
$data = json_decode($config, true);
// NULL, "Syntax error near location 2:5"

// After: opt in to comments and trailing commas
$data = json_decode($config, true, flags: JSON_ALLOW_COMMENTS | JSON_ALLOW_TRAILING_COMMAS);
// ['host' => 'localhost', 'port' => 5432, 'options' => ['persistent', 'utf8']]

What each flag allows#

JSON_ALLOW_COMMENTS allows // and /* */ comments anywhere JSON allows whitespace. The parser skips them, so they never show up in the result. A // inside a string is still part of the string, and # comments are still an error.

JSON_ALLOW_TRAILING_COMMAS allows one comma after the last item in an array or object. [1, 2,] decodes to [1, 2], but [1,,] is still an error.

You can pass either flag on its own. json_encode() doesn't change. It never writes comments or trailing commas.

Why build it in#

Removing comments yourself is harder than it looks. A regular expression can't always tell a comment from a string like "https://example.com/*". And once the comments are gone, error messages point to the wrong line. Handling comments inside the parser avoids both problems, and it lets json_validate() check these files too.

The RFC stops at comments and commas. It doesn't add JSON5 features like single quotes, unquoted keys or NaN. Later RFCs could add those as more flags, one at a time.

What it means for existing code#

Nothing changes unless you pass the new flags. The author ran 120,025 test inputs through the old and new parser and got the same results.

There are two edge cases. The RFC adds two global constants, so your own global constant with either name would clash. And json_decode() currently ignores flag values it doesn't know, so code that passes those values by accident would start accepting comments or trailing commas.

Where it stands#

Otar Chekurishvili opened the internals discussion on October 13, 2026. The RFC targets PHP 8.7, and the implementation is up as a php-src pull request. There will be two separate votes, one for each flag, and each needs a two-thirds majority.