Table of contents
Summary
Evaluates a string of JavaScript code without reference to a particular object.
| Core Global Method | |
|---|---|
| Implemented in | JavaScript ? |
| ECMAScript Edition | ECMAScript ? |
Syntax
eval(string)
Parameters
string- A string representing a JavaScript expression, statement, or sequence of statements. The expression can include variables and properties of existing objects.
Description
eval is a top-level function and is not associated with any object.
The argument of the eval function is a string. If the string represents an expression, eval evaluates the expression. If the argument represents one or more JavaScript statements, eval performs the statements. Do not call eval to evaluate an arithmetic expression; JavaScript evaluates arithmetic expressions automatically.
If you construct an arithmetic expression as a string, you can use eval to evaluate it at a later time. For example, suppose you have a variable x. You can postpone evaluation of an expression involving x by assigning the string value of the expression, say "3 * x + 2", to a variable, and then calling eval at a later point in your script.
If the argument of eval is not a string, eval returns the argument unchanged. In the following example, the String constructor is specified, and eval returns a String object rather than evaluating the string.
eval(new String("2 + 2")); // returns a String object containing "2 + 2"
eval("2 + 2"); // returns 4
You can work around this limitation in a generic fashion by using toString.
var expression = new String("2 + 2");
eval(expression.toString());
You cannot indirectly use the eval function by invoking it via a name other than eval; if you do, a runtime error might occur. For example, you should not use the following code:
var x = 2;
var y = 4;
var myEval = eval;
myEval("x + y");
Don't use eval!
eval() is a dangerous function, which executes the code it's passed with the privileges of the caller. If you run eval() with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage / extension. More importantly, third party code can see the scope in which eval() was invoked, which can lead to possible attacks in ways of which the similar Function is not susceptible.
eval() is also generally slower than the alternatives, since it has to invoke the JS interpreter, while many other constructs are optimized by modern JS engines.
There are safe (and fast!) alternatives to eval() for common use-cases.
Accessing member properties
You should not use eval to convert property names into properties. Consider the following example. We don't know which property of the object we want to access. This can be done with eval:
var obj = { a: 20, b: 30 };
var propname = getPropName(); //returns "a" or "b"
eval( "var result = obj." + propname );
However eval is not necessary here. In fact, its use here is discouraged. Instead, use the member operators, which are much faster and safer:
var obj = { a: 20, b: 30 };
var propname = getPropName(); //returns "a" or "b"
var result = obj[ propname ]; // obj[ "a" ] is the same as obj.a
Use functions instead of evaluating snippets of code
JavaScript has first-class functions, which means you can pass functions as arguments to other APIs, store them in variables and objects' properties, and so on. Many DOM APIs are designed with this in mind, so you can (and should) write:
setTimeout(function() { ... }, 1000); // instead of setTimeout(" ... ", 1000);
elt.addEventListener("click", function() { ... } , false); // instead of elt.setAttribute("onclick", "...");
Closures are also helpful as a way to create parametrized functions without concatenating strings.
Parsing JSON (converting strings to JavaScript objects)
If the string you're calling eval() on contains data (for example, an array: "[1, 2, 3]"), as opposed to code, you should consider switching to JSON, which allows the string to use a subset of JavaScript syntax to represent data. See also Downloading JSON and JavaScript in extensions.
Note that since JSON syntax is limited compared to JavaScript syntax, many valid JavaScript literals will not parse as JSON. For example, trailing commas are not allowed in JSON, and property names (keys) in object literals must be enclosed in quotes. Be sure to use a JSON serializer to generate the string, that will be later parsed as JSON.
Pass data instead of code
For example, an extension designed to scrape contents of web-pages could have the scraping rules defined in XPath instead of JavaScript code.
Run code with limited privileges
If must run code, consider running it with reduced privileges. This advice applies mainly to to extensions and XUL applications, which can use Components.utils.evalInSandbox for this.
Cross-implementation compatibility
It should be noted that the second optional parameter to eval is non-standard and not supported in all JavaScript implementations; at the time of this writing, for instance, Rhino doesn't support it, nor does Safari's JavaScriptCore.
To maintain compatibility across implementations, it is recommended that the second parameter to eval not be used. To achieve the same effect, the with statement may be used. So rather than using
eval(string, object);
use
with (object) {
eval(string);
}
Examples
The following examples display output using document.write. In server-side JavaScript, you can display the same output by calling the write function instead of using document.write.
Example: Using eval
In the following code, both of the statements containing eval return 42. The first evaluates the string "x + y + 1"; the second evaluates the string "42".
var x = 2;
var y = 39;
var z = "42";
eval("x + y + 1"); // returns 42
eval(z); // returns 42
Example: Using eval to evaluate a string of JavaScript statements
The following example uses eval to evaluate the string str. This string consists of JavaScript statements that open an Alert dialog box and assign z a value of 42 if x is five, and assigns 0 to z otherwise. When the second statement is executed, eval will cause these statements to be performed, and it will also evaluate the set of statements and return the value that is assigned to z.
var x = 5;
var str = "if (x == 5) {alert('z is 42'); z = 42;} else z = 0; ";
document.write("<P>z is ", eval(str));
Return value
eval returns the value of the last expression evaluated.
var str = "if ( a ) { 1+1; } else { 1+2; }";
var a = true;
var b = eval(str); // returns 2
alert("b is : " + b);
a = false;
b = eval(str); // returns 3
alert("b is : " + b);
