SoFunction
Updated on 2025-04-12

Analysis of precautions for JS using eval to parse JSON

This article analyzes the precautions for JS using eval to parse JSON in more detail. Share it for your reference, as follows:

There are generally two ways to parse JSON strings into JSON data format in JSON:

1. One is to use the eval() function.

2. Use Function object to perform return parsing.

Use the eval function to parse, and use the jquery's each method to traverse

The method of using jquery to parse JSON data is used as the transmission object for jquery asynchronous request. The result returned after jquery request is a json object. The server is considered here to return the form of a string in the form of JSON. For JSON objects encapsulated with plug-ins such as JSONObject, this is similar to this, and I will not explain it here.

Here we first give the JSON string set, the string set is as follows:

The code is as follows:

var data="
{
root:
[
{name:'1',value:'0'},
{name:'6101',value:'Beijing'},
{name:'6102',value:'Tianjin'},
{name:'6103',value:'Shanghai'},
{name:'6104',value:'Chongqing City'},
{name:'6105',value:'Weinan City'},
{name:'6106',value:'Yan'},
{name:'6107',value:'Hanzhong City'},
{name:'6108',value:'Yulin City'},
{name:'6109',value:'Ankang City'},
{name:'6110',value:'Shangluo City'}
]
}";

Here, based on the data types obtained by jquery asynchronously - json objects and strings, we introduce the results obtained in two ways.

1. For the JSON string returned by the server, if the jquery asynchronous request does not provide type description or is accepted as a string, then objectification processing is required. The method is not too troublesome, just put the string in eval() and execute it once. This method is also suitable for obtaining json objects in ordinary javascipt mode. The following examples are shown:

var dataObj=eval("("+data+")");//Convert to json objectRed roseWhy do you want it evalAdd to this “("("+data+")");//"Woolen cloth?

The reason is: the problem with eval itself. Since json starts and ends in the "{}" way, in JS, it will be processed as a statement block, so it must be converted into an expression in a mandatory manner.

The purpose of adding parentheses is to force the eval function to force the expression in brackets to be converted into objects when processing JavaScript code, rather than to execute as a statement. For example, for example, if the object literal {} is not added with outer brackets, then eval will identify the braces as the start and end marks of the JavaScript code block, and then {} will be considered to be executing an empty statement. So the following two execution results are different:

alert(eval("{}"); // return undefined
alert(eval("({})");// return object[Object]

For this writing method, you can see it everywhere in JS.

For example: (function()) {}(); When doing closure operations, etc.

alert();//The number of subobjects output to root$.each(,fucntion(idx,item){ 
if(idx==0){ 
return true; 
} 
//Output the name and value of each root child objectalert("name:"++",value:"+); 
})

Note: For general js generation json objects, you only need to replace the $.each() method with a for statement, and the others remain unchanged.

2. For the JSON string returned by the server, if jquery asynchronously requests to set type (usually this configuration property) to "json", or use the $.getJSON() method to obtain the server return, then the eval() method is not needed, because the result obtained at this time is already a json object, just call the object directly. Here, use the $.getJSON method as an example to illustrate the data processing method:

$.getJSON("/",{param:"gaoyusi"},function(data){ 
//The data returned here is already a json object//The following other operations are the same as the first case$.each(,function(idx,item){ 
if(idx==0){ 
return true;//Same country, return false and break} 
alert("name:"++",value:"+); 
}); 
});

It is particularly important to note here that the eval() method in Method 1 dynamically executes the string (probably a js script), which can easily cause system security problems. Therefore, some third-party client script libraries that evade eval() can be used, such as JSON in JavaScript that provides a script library that does not exceed 3k.

The second analysis method is to use Function object to complete it. Its typical application is to analyze the return data data under the AJAX method in JQUERY.

var json='{"name":"CJ","age":18}';
data =(new Function("","return "+json))();

At this time, data will be parsed into a json object.

I hope this article will be helpful to everyone's JavaScript programming.