3 ms·
Strangely long article for what amounts to: server runs eval on user input, security problems follow.
by kzahel 14y ago
Strangely long article for what amounts to: server runs eval on user input, security problems follow.
- firefoxman1 14y agoIt's funny how we've been taught for years not to use eval for "security reasons" and I always thought "eh, how much harm can someone do in their own browser? But I won't use eval anyway." ...then Node came along and I vowed to never consider eval even an option. I mean, that's a HUGE risk if you eval any user input on the server side. In fact, the only valid use I've seen for eval is template engines like Jade, but they don't touch user input.