Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.mixmin.net!feeder.erje.net!eu.feeder.erje.net!xlned.com!feeder1.xlned.com!npeer.de.kpn-eurorings.net!npeer-ng0.de.kpn-eurorings.net!newsfeed.arcor.de!newsspool2.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Content-Type: text/plain; charset="ISO-8859-1"
Message-ID: <2261899.gBobAo4G4S@PointedEars.de>
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Organization: PointedEars Software (PES)
Date: Fri, 09 Nov 2012 17:46:59 +0100
User-Agent: KNode/4.4.11
Content-Transfer-Encoding: 7Bit
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Subject: Re: eval - how to
Newsgroups: comp.lang.javascript
References: <k7iqg9$n49$1@speranza.aioe.org>
Followup-To: comp.lang.javascript
MIME-Version: 1.0
Lines: 34
NNTP-Posting-Date: 09 Nov 2012 17:46:59 CET
NNTP-Posting-Host: f55ee6ae.newsspool2.arcor-online.net
X-Trace: DXC=4U7l<HbncFmUoRk[hk2WalA9EHlD;3Ycb4Fo<]lROoRa8kF<OcfhCOkT`38E:`OojhDZm8W4\YJNlJ`:FmdeL>K`ehLF0A91V>hW[[7HSFnmUo
X-Complaints-To: usenet-abuse@arcor.de
Xref: csiph.com comp.lang.javascript:17100

Cezary Tomczyk wrote:

> According to "Better not use eval() because ... ":
> 
> How to use eval in a correct way?
> 
> For example when I'll get the JavaScript (or any other EcmaScript
> implementation) code through XMLHttpRequest then how to safely eval the
> code?

(It's _ECMAScript_, published by _Ecma_ International, for historical 
reasons.)

The only way to safely use eval() is a) not to use it or b) to be sure that 
you are using a conforming implementation of ECMAScript Ed. 5 or later 
(where the scope chain of eval code is empty; which you really cannot be 
sure about in a browser). 

But if you really must use eval(), and want to/need to parse JSON(-like 
data) with it (instead of with JSON.parse()), be sure that the literal is 
evaluated in an expression context:

   var obj = eval("(" + JSON_object_string + ")");

The `(' and `)' would be necessary because the `{' and `}' of an object 
literal also delimit a Block statement, whose production takes precedence in 
a statement context.


PointedEars
-- 
Danny Goodman's books are out of date and teach practices that are
positively harmful for cross-browser scripting.
  -- Richard Cornford, cljs, <cife6q$253$1$8300dec7@news.demon.co.uk> (2004)