Take the 2-minute tour ×  Eval is a notoriously controversial
language feature. Douglas Crockford flat out rejects it. I'm
wondering what specific risks Eval brings about. According to
this question, Improper use of eval opens up your code for
injection attacks.  What are some improper uses of the Eval
command, and what security holes do they open up?  share|improve
this question add comment  6 Answers  Back when I was
implementing the JScript engine I advocated having EVAL IS EVIL
shirts printed up but sadly we never got around to it.  My
biggest problem with eval is not the obvious malicious code
injection attack, though that is certainly of enormous concern.
My biggest problem with it is that people tend to use it as a
Really Big Hammer to solve really small problems. Most of the
real-world usages I saw of "eval" in the wild when I was on the
JScript team could have been trivially solved by using a lookup
table; and since every object in JScript already is a lookup
table it's not like that was an onerous b