Question

As shown in this example

javascript-use-variable-as-object-name

I am using eval to use a DOM attribute to select an element from an array. Though there is no direct way for the user to change the input, I want to be as secure as possible and make sure that the variable is indeed an integer before I evaluated it.

Which of the following would be the best, most secure, way?

$(".listitem").click(function(){
    var id = $(this).attr("record-id");
    if(!isNaN(new Number(id))){
        Storage.search.nearby.currec = rowsHolder[eval(id)];
    }else{
        // send email to admin, shut down
    }
});

or

$(".listitem").click(function(){
    var id = $(this).attr("record-id");
    if(parseInt(id)){
        Storage.search.nearby.currec = rowsHolder[eval(id)];
    }else{
        // send email to admin, shut down
    }
});

More, but not required info:

Basically I am pulling down a large JSON string from online, containing an array of records. Upon building a table from the info using a for statement ( for(i in array) ), I push each row into an array called rowsHolder and give the tr an attribute of record-id=”i”. Then when the user clicks the row, I call the method you see above. I am using PhoneGap with JQuery Mobile.

As always, thanks for the input

-D

Answer 1

There is absolutely no reason to use eval here.

• If your id is kind of a number, use parseFloat(id) to get it. Unnecessary as it would be converted back to a string when used as a property name, though.
• If your id is an integer, use parseInt(id, 10) to get it. Unnecessary as it would be converted back to a string when used as a property name, though.
• If your id is a string, just let it be a string. The property name you use it for would be one anyway.