5 ms·
Isn't it dangerous to eval()? Suppose someone put some malicious code in the JSON data?
by Luyt 17y ago
Isn't it dangerous to eval()? Suppose someone put some malicious code in the JSON data?
- wlievens 17y agojQuery includes a proper parser
- Hexstream 17y agoI think it was even being incorporated in browsers natively for maximum performance. It might be available already.
- enomar 17y agohttp://ejohn.org/blog/the-state-of-json/ http://ejohn.org/blog/the-state-of-json/
- euroclydon 17y agoWhere?
- DrJokepu 17y agoThe question to ask is: is the JSON coming from a trusted source (e.g. generated by your server and you can reasonably sure that you have no funny XSS holes)? If the answer is yes, eval()-ing JSON is perfectly safe. If the answer no, you need to parse it without the help of the JS interpreter.
- eru 17y agoAnd you should probably err on the safe side.
- sp332 17y agoFirefox has a native JSON parser. http://blog.mozilla.com/webdev/2009/02/12/native-json-in-firefox-31/ http://blog.mozilla.com/webdev/2009/02/12/native-json-in-fir...