Alex Rivera | Logout

Why is using the JavaScript eval function a bad idea?

Asked 2008-09-17T19:09:54.803
587

The eval function is a powerful and easy way to dynamically generate code, so what are the caveats?

Edit
Report

1 Answer

5

It's not necessarily that bad provided you know what context you're using it in.

If your application is using eval() to create an object from some JSON which has come back from an XMLHttpRequest to your own site, created by your trusted server-side code, it's probably not a problem.

Untrusted client-side JavaScript code can't do that much anyway. Provided the thing you're executing eval() on has come from a reasonable source, you're fine.

answered 2008-09-17T20:10:08.700

Your Answer