Question

var x = Object.create(null);
x["hello"] = "world";

But can I allow unverified user input as keys? I want to use it as player name -> player object map. Player names will only be constrained by length of 32. I’m worried if there are special property keys that would allow players to gain control of the server.

EDIT: I’m not making web server. JavaScript will be ran server-side via SpiderMonkey embedded into the game server. If someone hijacks the JavaScript running there, they could ruin the game.

Answer 1

In one word: no, just remember the Google Docs __proto__ fail

You should use a Hash-like class, or at least access these keys prefixed:

var hash = {}, key = "something-evil", value = Math.PI;
hash["$" + key] = value;
console.log( hash["$" + key] == value );