Are ES6 template literals safer than eval?
<p>Template literals smell a bit like eval to me, and it's often cited that <a href="https://stackoverflow.com/questions/86513/why-is-using-the-javascript-eval-function-a-bad-idea">using eval is a bad idea</a>.</p>
<p>I'm not concerned with <a href="https://stackoverflow.com/questions/29055518/are-es6-template-literals-faster-than-string-concatenation">performance of template literals</a>, but I am concerned about injection attacks (and other security concerns I may not be thinking of).</p>
<p><strong>Edit</strong></p>
<p><a href="https://jsfiddle.net/anthonyastige/L8d17xwa/" rel="noreferrer">An example of something that feels odd to me</a></p>
<pre><code>let ii = 1;
function counter() {
    return ii++;
}
console.log(`${counter()}, ${ii++}, ${counter()}`);
</code></pre>
<p>Which outputs</p>
<blockquote>
<p>1, 2, 3</p>
</blockquote>
<p>The template literal is making side effects at the global level.  Both by a function, and directly.</p>
<p><strong>Edit 2</strong></p>
<p><a href="https://jsfiddle.net/anthonyastige/68n0Lefs/4/" rel="noreferrer">An example indicating the saferness of template literals</a></p>
<pre><code>let ii = 1;
let inc = function() { ii++; }
console.log('Starting: ' + ii);
let input = prompt('Input something evil (suggestion: inc() or ii++)');
console.log(`You input: ${input}`);
console.log('After template literal: ' + ii);
eval(input);
console.log('After eval: ' + ii);
</code></pre>
<p>If you input <code>ii++</code> when prompted, it logs</p>
<blockquote>
<p>Starting: 1</p>
<p>You input: ii+=1</p>
<p>After template literal: 1</p>
<p>After eval: 2</p>
</blockquote>
<p><strong>Edit 3</strong></p>
<p>I've started looking into the ECMAScript specification</p>
<ul>
<li><a href="http://www.ecma-international.org/ecma-262/6.0/#sec-eval-x" rel="noreferrer">18.2.1 - Function Properties of the Global Object :: Eval (x)</a>
<ul>
<li>Notice it's on the global object</li>
<li>Notice the very next section is about 'Runtime Semantics' of eval</li>
</ul>
</li>
<li><a href="http://www.ecma-international.org/ecma-262/6.0/#sec-template-literals" rel="noreferrer">12.2.9 - Primary Expression :: Template Literals</a>
<ul>
<li>Notice it's an expression</li>
<li>Notice the next section is about 'Static Semantics' of TemplateStrings</li>
</ul>
</li>
</ul>
<p>Though I'm not grokking the details, it feels like template literals are specified safer than eval.</p>