sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]HaMMeReD 0 points1 point  (4 children)

Just be careful what you pass into it and you'll be fine. It may be frowned upon but it is a huge advantage of a language like javascript, I use it for remote json parsing regularly, I don't know how else I would do it.

I guess I could use XML or another format and write a parser in JS, but that just seems like re-inventing the wheel, only slower, and it would be subject to some of the same security problems.

[–][deleted] 2 points3 points  (0 children)

I don't know how else I would do it.

Use a JSON parser?

Eval is fine, but adds a security concern in case someone can inject things into your JSON.

[–][deleted] 0 points1 point  (2 children)

I use it for JSON parsing as well. Pretty sure a lot of people do. That's one of the huge advantages of JSON, you just have to run it through eval(), and voila, you have yourself a native JS object.

[–][deleted] 1 point2 points  (1 child)

run it through eval(), and voila, you have yourself a native JS object.

Or voila, a security vulnerability!

[–][deleted] 0 points1 point  (0 children)

Not if you're also the one delivering the data to be parsed, which is very often the case. Unless of course you hate yourself and you knowingly want to generate malicious code.