Tutorial

Reasons Why You Should Never Use eval() in JavaScript

Published on August 26, 2019
author

William Le

Reasons Why You Should Never Use eval() in JavaScript

While we believe that this content benefits our community, we have not yet thoroughly reviewed it. If you have any suggestions for improvements, please let us know by clicking the “report an issue“ button at the bottom of the tutorial.

The eval() function has been around for a long time in JavaScript! You likely don’t see it often anymore because it’s widely agreed that it’s harmful to use. Let’s take a brief look at it, and some of the dangers associated with using it.

The keyword eval is an abbreviation for “evaluate.” The function essentially takes a string with JavaScript code and will evaluate it for you.

eval('2 + 3 + 1');
// 6

You can evaluate a simple expression… Or a bunch of JavaScript code!

var foo = 2;

eval('var bar = 3;\
var baz = 1;\
\
function addStuff() {\
  return foo + bar + baz;\
}\
\
addStuff();\
');
// 6

Reasons to Avoid Using   eval()

Unless you are doing really high-level JavaScript (see below) the risks usually outweigh the benefits of using eval(). Here’s some of the reasons to avoid using it:

  • Malicious code: invoking eval can crash a computer. For example: if you use eval server-side and a mischievous user decides to use an infinite loop as their username.
  • Terribly slow: the JavaScript language is designed to use the full gamut of JavaScript types (numbers, functions, objects, etc)… Not just strings! Using eval is orders of magnitude slower than normal JavaScript code.

Considering that eval() is still part of the ECMAScript standard… Are there any appropriate uses for it?

Legitimate Uses for   eval()

There’s a small subset of JavaScript development that requires using eval. These include: developing template libraries, interpreters, command lines and module systems. Most of these types of software development are meta-programming and build tools.


If you’re unsure whether to use eval, try doing a quick search on StackOverflow. There’s almost always a better approach.

Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.

Learn more about us


About the authors
Default avatar
William Le

author

Still looking for an answer?

Ask a questionSearch for more help

Was this helpful?
 
Leave a comment


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Join the Tech Talk
Success! Thank you! Please check your email for further details.

Please complete your information!

Featured on Community

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel