Safe evaluation

Learn the risks of eval and the Function constructor and safer alternatives.

The risk of eval and new Function

eval and new Function run the string they receive as JavaScript code. If you pass user data through them, an attacker can run any code.

So these constructs are almost never used in applications. The same risk arises when you pass a string to setTimeout; always pass a function instead.

Bracket notation is safe

Sometimes you know a property name only at runtime. The wrong way is to use eval('obj.' + key). The right way is bracket notation: obj[key].

Bracket notation only reads a property; it runs no code. Even if the key comes from the user, it is just data access; injection is not possible. Always prefer this path for dynamic access.

Exercise Safe value access

Write a function safeGetValue, parameters obj and key. Return the property value with return obj[key].

Show example solution

First define the function, then write return obj[key].
Example solution:
function safeGetValue(obj, key) {
  return obj[key];
}

Test yourself

Which is safe for dynamic property access?
```
const obj = { a: 1, b: 2 };
const key = getUserInput();
// access a property of obj
```
- eval('obj.' + key)
- new Function('return obj.' + key)()
- setTimeout('obj.' + key, 0)
- obj[key]
Show answer

obj[key] — Correct! obj[key] only reads a property; it runs no code.

Complete the bracket access

const value = config[____];

Show answer

const value = config[key];

Match the access methods

eval

runs code
new Function

creates code
obj[key]

reads a property
setTimeout(fn)

schedules

Next lesson: Input sanitization

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies