You could probably write a more advanced check than just "{" that would let most JSON through while still blocking the attack.