Question

I have this function call passed as a string:

var dcall = "tumbsNav(1)";

Is it possible to execute this dynamically like exec in SQL??

exec(dcall)

Answer 1

Wherever you’re storing

var dcall = "tumbsNav(1)";

You can instead store

var dcall = function() {
   return tumbsNav(1);
};

Wherever you were calling it, instead of calling

eval(dcall);

You can instead call

dcall();

The only case this wouldn’t work is if tumbsNav wasn’t defined at the time var func = ... is called. Then you would have to store the string. If the string is completely under your control, then there’s no security hole, but be aware of all the problems mentioned by @Porco

As Kolink mentioned, my example would not cause a problem if tumbsNav was not defined when assigning it with a wrapped anonymous function that calls tumbs. The comment above would only make sense if the example had been the following:

var dcall = tumbsNav, darg = 1;
// later in the code, you can call
dcall(darg) ;