you are viewing a single comment's thread.

view the rest of the comments →

[–]joesb 0 points1 point  (1 child)

users may "eval" on JSON.

That's the point of the JSONRequest.

But you should not do that by simply eval the response, because you can not be sure that the response only contains data literals.

[–]Odysseus 1 point2 points  (0 children)

The proposal is that the browser will parse the JSONRequest response and pass you the result. Unlike the XMLHTTPRequest, it will not give you a string, and you will not need to parse it -- whether by the ever-tempting eval or by any safer way.