How can javascript interpreters such as phpv8js only check the syntax of js Code and not execute it?

Recently, I used PHP as a small software program in my company. I have several requirements for verifying the syntax of the JS Code submitted by users. I installed the v8js extension and wrapped the submitted code in the function & quot; varxfunction () {user JS Code} & quot ;, use this method to verify the customer code without executing it... recently, I used PHP as a small software program in my company. I have several requirements for verifying the syntax of the JS Code submitted by users. I installed the v8js extension and wrapped the submitted code in the function "var x = function () {user JS Code }", this method is used to verify the customer code without executing it.

The experiment works well, but the problem is that the above method may be used by smart users, resulting in the risk of injection. for example, the customer enters the code "}; some dangerous code", which may cause great trouble.

Is there any way to verify the syntax of the JS Code without executing the JS Code?

V8js extension documentation: http://cn2.php.net/manual/zh/class.v8js.php

Reply content:

Recently, I used PHP as a small software program in my company. I have several requirements for verifying the syntax of the JS Code submitted by users. I installed the v8js extension and wrapped the submitted code in the function "var x = function () {user JS Code }", this method is used to verify the customer code without executing it.

The experiment works well, but the problem is that the above method may be used by smart users, resulting in the risk of injection. for example, the customer enters the code "}; some dangerous code", which may cause great trouble.

Is there any way to verify the syntax of the JS Code without executing the JS Code?

V8js extension documentation: http://cn2.php.net/manual/zh/class.v8js.php

Try javascriptlint or jslint.

Tracking code found that in PHP's V8 extension, JavaScript verification is performed inside the code before execution. Therefore, you only need to modify the code and let it return after verification, you can check the syntax without executing the code.