JavaScript advanced series-why not use eval

Source: Internet
Author: User
The eval function executes a JavaScript code string in the current scope.
  • Disguised eval

  • Security Questions

  • Conclusion

The eval function executes a JavaScript code string in the current scope.

var foo = 1;function test() {    var foo = 2;    eval('foo = 3');    return foo;}test(); // 3foo; // 1

However, eval is executed in the current scope only when it is called directly and the called function is eval itself.

var foo = 1;function test() {    var foo = 2;    var bar = eval;    bar('foo = 3');    return foo;}test(); // 2foo; // 3

Note: The above code is equivalent to calling eval in the global scope. It works the same as the following two statements:

// Statement 1: directly call the foo variable var foo = 1 under the global scope; function test () {var foo = 2; window. foo = 3; return foo;} test (); // 2foo; // 3 // Method 2: Use the call function to modify the eval execution context to the global scope var foo = 1; function test () {var foo = 2; eval. call (window, 'foo = 3'); return foo;} test (); // 2foo; // 3

In any case, we should avoid using the eval function. 99.9% eval is not used in all scenarios.

Disguised eval

Both the timer functions setTimeout and setInterval can accept strings as their first parameters. This string is always executed in the global scope, so eval is not directly called in this case.

Security Questions

Eval also has security issues because it executes any code that is passed to it. When the code string is unknown or comes from an untrusted source, do not use the eval function.

Conclusion

Do not use eval. Any code that uses it will be questioned in terms of its working method, performance, and security. In some cases, if eval must be used for normal operation, its design will be questioned first. This should not be the preferred solution, A better solution that does not use eval should be fully considered and prioritized.

The above is the JavaScript advanced series-why not use eval content. For more information, see PHP Chinese website (www.php1.cn )!

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.