Your biggest risk would be older versions of Internet Explorer that attempt to auto-detect the encoding as UTF-7 - called Codepage Sniffing.

It appears that Internet Explorer will only do this for webpages, and not for AJAX requests. Therefore JSON requests should be safe. Moreover, JSON requests do not cause rendering of content directly to the page - they would need JavaScript processing in order to manipulate the DOM, so this would only be of concern when you were retrieving data that has supposedly been pre-HTML encoded. Therefore if the JSON data is HTML encoded on the client, the encoding of the page should take precedence and would not cause conversion of +ADw- character sequences to angle brackets, which is where the risk lies with UTF-7.

So I would say specifying charset=utf-8 is only necessary for Content-Type: text/html pages.

application/json Content-Type character set
I am trying to figure out how people use the __LINE__ macro at work. How do you guys use it?
