// Tutorial //

Reasons Why You Should Never Use eval() in JavaScript

Published on August 26, 2019
Default avatar
By William Le
Developer and author at DigitalOcean.
Reasons Why You Should Never Use eval() in JavaScript

While we believe that this content benefits our community, we have not yet thoroughly reviewed it. If you have any suggestions for improvements, please let us know by clicking the “report an issue“ button at the bottom of the tutorial.

The eval() function has been around for a long time in JavaScript! You likely don’t see it often anymore because it’s widely agreed that it’s harmful to use. Let’s take a brief look at it, and some of the dangers associated with using it.

The keyword eval is an abbreviation for “evaluate.” The function essentially takes a string with JavaScript code and will evaluate it for you.

eval('2 + 3 + 1');
// 6

You can evaluate a simple expression… Or a bunch of JavaScript code!

var foo = 2;

eval('var bar = 3;\
var baz = 1;\
\
function addStuff() {\
  return foo + bar + baz;\
}\
\
addStuff();\
');
// 6

Reasons to Avoid Using   eval()

Unless you are doing really high-level JavaScript (see below) the risks usually outweigh the benefits of using eval(). Here’s some of the reasons to avoid using it:

  • Malicious code: invoking eval can crash a computer. For example: if you use eval server-side and a mischievous user decides to use an infinite loop as their username.
  • Terribly slow: the JavaScript language is designed to use the full gamut of JavaScript types (numbers, functions, objects, etc)… Not just strings! Using eval is orders of magnitude slower than normal JavaScript code.

Considering that eval() is still part of the ECMAScript standard… Are there any appropriate uses for it?

Legitimate Uses for   eval()

There’s a small subset of JavaScript development that requires using eval. These include: developing template libraries, interpreters, command lines and module systems. Most of these types of software development are meta-programming and build tools.


If you’re unsure whether to use eval, try doing a quick search on StackOverflow. There’s almost always a better approach.


Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in our Questions & Answers section, find tutorials and tools that will help you grow as a developer and scale your project or business, and subscribe to topics of interest.

Sign up
About the authors
Default avatar
Developer and author at DigitalOcean.

Still looking for an answer?

Was this helpful?
Leave a comment