3 ms·
Looking at his source, he does an eval() in the first line of his response handler for the flickr example. I imagine you could do a JSON.parse() instead of eval
by lux 18y ago
Looking at his source, he does an eval() in the first line of his response handler for the flickr example. I imagine you could do a JSON.parse() instead of eval() -- preferably! -- but if he says it's secure, what about that line?
- tlrobinson 18y agoThey key here though is that evaluating untrusted code from a 3rd party site is not a requirement of the transport. That eval is in the client code and it could just as easily be a safer alternative (either checking that it's sanitary with a regex or using a library's JSON decode function) With JSONP you necessarily have to execute untrusted code, since JSONP works by loading JavaScript in a <script> tag.
- lux 18y agoI see. Thanks for that info, I wasn't familiar with JSONP's technique. In that case, this does sound like a pretty cool library!