Question

Possible Duplicate:
When is JavaScript's eval() not evil?

I was wondering,

besides Eval activates the interpreter again, causing overhead,

the only situation in which it can be bad (except what I’ve just written), is when JS sends data (which is eval'd) to server.

I don’t see any other scenario, if a user wants to play with the js, he will play only in his browser boundaries (unless JS is interacting with Server).

Am I right?

I’d be happy for corrections.

Answer 1

Strictly speaking, there is nothing actually, phsyically harmful in using eval, because it does nothing more than what the browser’s console can already do.

There is a potential danger of injection, but that’s the same risk as putting any user-supplied input into a <script> tag, not a particularity of eval.

The main reason to avoid eval is because it has to interpret a string. Now, to be fair, just running a JavaScript file is basically the same as calling a great big eval over the whole file (broadly speaking), because JavaScript is interpreted (or at most compiled at run-time). Therefore, using eval sparsely, where it only gets run, say, when a user clicks on a button, is fine. Noticeable effects will only appear if you end up with eval running frequently, such as in a loop. This is why people will always tell you to pass a function to setTimeout instead of a string, for instance.

That said, there is always an alternative to using eval. It may require rewriting parts of older code, but it’s always avoidable.