Why is it not recommended to use the Eval () function in JavaScript?

Eval Camouflage
The timeout function settimeout and setinterval both accept the string as the first argument, and the string is executed at the global scope because eval is not called directly.

Security issues
Eval also has a security issue because it can execute any string passed to it, so never pass in a string or an argument from a source that is unknown or untrusted.

In this example, because the text of the response contains an anonymous function, the function modifies the Action property of the first form on the page, causing the form to be referred to a different server when it commits. Therefore, if the JSON data is not filtered and passed directly to Eval (), it is likely to be subject to XSS attacks. Because any JavaScript code returned by the server is evaluated in the context of the page after it is passed to Eval (), it can run as a class member and manipulate the data in the page.

Therefore, we should avoid passing the JavaScript function returned by the server into the eval () function.

Working with JSON strings
Processing the JSON string requires adding "(" and ")".

Scope of Eval
Under FF and Chrome, the following two pieces of code are very different (ie does not have this problem, the Magic Browser ~):
Code one (local scope, ie in this way):

Code two (global scope, IE takes the execScript place of substitution):

If you don't use the eval () function to replace

"High-performance JavaScript," a book that says:

Warning: With regard to JSON and eval, it's important to note that using eval in code is dangerous, especially if you use it to execute third-party JSON data, which may contain malicious code.
Use the Json.parse () method whenever possible to parse the string itself. This method captures syntax errors in JSON and allows you to pass in a function that filters or transforms the parsing results.
If this method is for Firfox 3.5, IE8, and Safari 4 native support. Most JavaScript class libraries contain JSON parsing code that calls the native version directly.
If there is no native support, a slightly less powerful non-native version is called for processing.

Why is it not recommended to use the Eval () function in JavaScript?