Well JSON hijacking would be relevant when sending JSON back in the response body, it has no relevance in the request body.