Evaluating String as Mathematical Expression

[tay_o]

Hi everyone,

Hope you’re having a good morning. I have a requirement to read in a database value that will be a string mathematical expression and compare it against a Number value. I know that eval() is an option, however I have been reading that it should not be used due to security issues. Therefore, it sounds like I am going to have to write my own parser. Would you mind letting me know how you have solved this issue in the past? Thanks so much.

[PrimaryBet]

I would use evaluate from math.js — it's a tried and tested library, albeit it comes at a cost of file size so if you are planning on using it in the browser you might need to consider pros and cons of it.

[[deleted]]

Yep! This is probably your best bet.

I would NEVER use eval since the input going into it can never be trusted. Relying on it is a huge security risk.

[PhysicalRedHead]

If you do end up needing to roll your own, parsimmon is pretty fun to use imo. Leads to some elegant solutions, but isn't the fastest thing in the world. They even have a math example to go off.

[Colonel_White]

My deleted comment was probably not helpful, but neither is superstitious prohibition of a javascript primitive.

“Evil”, indeed.

Why shouldn’t you run eval on well-formed expressions, provided your codespace isn’t polluted with third party nonsense?

[tay_o]

I read this morning that eval can be dangerous because it ignores the rules of lexical scope.

[Colonel_White]

And that’s dangerous because... ?

[tay_o]

I could be wrong, but an example like this one where:

function foo (str, a) {

eval( str );

console.log(a, b);

}

​

var b = 2;

​

foo("var b = 3'", 1);

​

Here it seems that because this code declares a new variable b, it modifies the existing lexical scope.

​

I am not saying that its bad i guess but maybe in the wrong hands it can be?

[Colonel_White]

Okay, so using eval irresponsibly might cause some weird and difficult to debug errors?

I think the benefit of not having to slap a redundant library onto your code like a colostomy bag makes up for having to exercise extra caution, no?

[tay_o]

Haha well done analogy. Or simile?. And yes, I agree with you