Question

i found some code which is using anchor tags in eval

eval("a='http://google.co.in'+window .location.href");

The code does not yield an error at the same time it is not redirecting to the desired page. By observing this piece of code i want to know whether javascript eval() can be used to create html tags like eval('script tag') or not.

Answer 1

eval does only evaluate JavaScript code. To fetch a DOM tree from a string, one of the following methods can be used:

1. Set the innerHTML property of a DOM element.
2. document.write('..html here..') and document.writeln('..html here...').
   Warning: The last method will overwrite the current document when the page has already finished loading.

Examples:

1. document.body.innerHTML = '<a href="http://stackoverflow.com/">Stack</a>';
   Replaces the body with a single link.
2. document.write('<a href="http://st.tk">Test</a>');