javascript - what does eval do and why its evil? -


this question has answer here:

var mystring = "x",     myobject = {         x: 10     }, value = eval("myobject." + mystring); alert(value) alert(myobject[mystring]);

http://jslinterrors.com/eval-is-evil/

i have been reading eval() function on internet, not grasp on apart "it evaluates expression".

should use eval() function numeric values?.

eval() takes string given, , runs if plain javascript code.

it considered "evil" because:

  • it over-complicates things - cases eval() used, there simpler solution didn't require it. example in question perfect case in point: there absolutely no need eval() expression this. js has syntax referencing object property name string (myobject["x"] same myobject.x).

  • it's harder debug - it's harder work in debugger, , once have managed work out what's going on, have work because have debug both eval'd code, , code generated original string eval.

  • it slows things down - script compiler cannot pre-compile code in eval(), because doesn't know code contain until gets there. lose out on of performance benefits in modern javascript engines.

  • it hacker's dream - eval() runs string code. hackers love because it's easier inject string program inject code; eval() means can inject string, , run code. eval() makes code easier hack. (this less of issue browser-based javascript other languages, js code accessible in browser anyway, security model should not based on code being immutable, nevertheless, injection hacks can still problem, particularly cross-site attacks).


Comments

Post a Comment

Popular posts from this blog

c# - Send Image in Json : 400 Bad request -

from android trying send image class of data, iis webservice. (c#) the problem 400 bad request . the image being encoded base64 . , placed json rest of class elements. my guess base64 not valid inside json. server not understand it. if set string "" , post accepted fine. so question is, how make base64 valid within json array? ( tried url.encode no success). or how should send image android webservice? gson gson = new gson(); string json = gson.tojson(record); // record has param { string base64photo } how big image? i'm pretty sure surpassing iis json size limit (default 4 mb). check http://geekswithblogs.net/frankw/archive/2008/08/05/how-to-configure-maxjsonlength-in-asp.net-ajax-applications.aspx or http://www.webtrenches.com/post.cfm/iis7-file-upload-size-limits good luck!
Read more

javascript - addthis share facebook and google+ url -

i attempting use addthis create simple url shares whichever current page user on when click share button. of right now, have twitter working. when user clicks, able see url populated in tweet box. when user clicks facebook or google+, url doesn't seem show in share box. <ul class="addthis_toolbox addthis_default_style "> <li><a class="addthis_button_facebook"><img src="/img/facebook-social.png" width="20" height="20" border="0" alt="share" /></a></li> <li><a class="addthis_button_twitter"><img src="/img/twitter-social.png" width="20" height="20" border="0" alt="share" /></a></li> <li><a class="addthis_button_google_plusone_share"><img src="/img/google-social.png" width="20" height="20" border="0" alt="s...
Read more

ios - Show keyboard with UITextField in the input accessory view -

i have buttona , when buttona clicked, want keyboard show uitextfield in inputaccessoryview. there way have keyboard show manually , set inputaccessoryview without having uitextfield initially? thanks. you cannot summon keyboard without object can become first responder. there 2 ways work around: subclass uiview , implement uikeyinput protocol in it. example: in .h file: @interface inputobject : uiview<uikeyinput> @property (nonatomic, copy) nsstring *text; @property (nonatomic, strong) uiview *inputaccessoryview; // must override inputaccessoryview , since it's readonly default @end in .m file, implement protocol: - (bool)canbecomefirstresponder { return yes; } - (bool)hastext { return [self.text length]; } - (void)inserttext:(nsstring *)text { nsstring *selftext = self.text ? self.text : @""; self.text = [selftext stringbyappendingstring:text]; [[nsnotificationcenter defaultcenter] postnotificationname:kinputobjec...
Read more