CODEWITHSUNDEEP
javascripteval
Isaac Hager
Isaac Hager

Reputation: 23

Whats up with eval()?

I've seen a lot about how the eval() function is evil; not a wise choice for HTML/JavaScript programming. I would like to use a function where I can pass in a string to have it read as a variable name, and eval() seems to do just that, but I don't want to use a destructive function.

From what I understand, the issue with eval() is that it can read third-party input as actual code, which opens a door for malicious activity. I have a map element that keeps track of location using strings for the location names. I also have large blocks of text assigned to variables so I can pull up a description of the current location easily. This seems like an acceptable time to use eval, as the strings that I would be passing in would be provided by other parts of the code. Is this a fair judgement, or is there some other function that I should be using?

Upvotes: 0

Views: 254

Answers (3)

Samathingamajig
Samathingamajig

Reputation: 13245

For a simple way to use a variable name as a string is to use an Object (called a dictionary or map in some languages)

const stringToGrade = {
  "freshman": 9,
  "sophomore": 10,
  "junior": 11,
  "senior": 12,
};

document.querySelector("#btn").addEventListener("click",  () => {
  const asString = document.querySelector("#inp").value.toLowerCase();
  const grade = stringToGrade[asString];
  console.log(`Your grade number is ${grade}`);
});
<input id="inp" placeholder="Enter your grade level (freshman, sophomore, etc.)" />
<button id="btn">Submit</button>

Upvotes: 1

Marco
Marco

Reputation: 7261

From what I understand, the issue with eval() is that it can read third-party input as actual code, which opens a door for malicious activity.

This is not the only reason. One could argue that by today's standards the performance of JavaScript code is negligible.

However, one has to take into account that eval() actually invokes the JavaScript interpreter which is significantly slower than writing the code upfront. ¹

I would like to use a function where I can pass in a string to have it read as a variable name, and eval() seems to do just that, but I don't want to use a destructive function.

This does not warrant the use of eval(). As mentioned in the comments, you can achieve this with keeping track of variables in an object:

let vars = {}

vars["some_variable_name"] = "test"

const var_name = "some_variable_name"

console.log(vars[var_name]) // "test"

as the strings that I would be passing in would be provided by other parts of the code

Might be, but what if in the future some piece of that code actually does process some user input?

Not worth the performance penality and obvious security risk in my opinion.

Upvotes: 1

user12734467
user12734467

Reputation:

(Moving my comment as an answer)

An easy way to get around that is to save whatever variable you're interested in accessing in a javascript Object (i.e. key-value pairs), and access them via indexing. This simple use case doesn't need eval.

Upvotes: 3

Related Questions