javascript - what does eval do and why its evil? -

this question has answer here:

var mystring = "x",     myobject = {         x: 10     }, value = eval("myobject." + mystring); alert(value) alert(myobject[mystring]);

i have been reading eval() function on internet, not grasp on apart "it evaluates expression".

should use eval() function numeric values?.

eval() takes string given, , runs if plain javascript code.

it considered "evil" because:

it over-complicates things - cases eval() used, there simpler solution didn't require it. example in question perfect case in point: there absolutely no need eval() expression this. js has syntax referencing object property name string (myobject["x"] same myobject.x).
it's harder debug - it's harder work in debugger, , once have managed work out what's going on, have work because have debug both eval'd code, , code generated original string eval.
it slows things down - script compiler cannot pre-compile code in eval(), because doesn't know code contain until gets there. lose out on of performance benefits in modern javascript engines.
it hacker's dream - eval() runs string code. hackers love because it's easier inject string program inject code; eval() means can inject string, , run code. eval() makes code easier hack. (this less of issue browser-based javascript other languages, js code accessible in browser anyway, security model should not based on code being immutable, nevertheless, injection hacks can still problem, particularly cross-site attacks).

Detect