JavaScript eval() Function

Last Updated : 04 Feb, 2025

The eval() function in JavaScript is a powerful but potentially dangerous feature that allows the execution of JavaScript code stored in a string. While eval() can be useful in some cases, its use is generally discouraged due to security risks and performance concerns.

Executing JavaScript Code with eval()

let a = 15;
let b = 5;
let oper = "a / b";
let res = eval(oper);
console.log(res);

Output

Recommended Alternative (Avoiding eval())

let a = 15;
let b = 5;
let res = a / b;
console.log(res);

Output

The eval() method evaluates or executes an argument:

If the argument is an expression, eval() evaluates it.
If the argument contains one or more JavaScript statements, eval() executes them.

Syntax

eval(string)

string: A JavaScript expression, variable, statement, or sequence of statements to be executed.
Returns the result of the evaluated expression.

Security Risks and Why You Should Avoid eval()

1. Security Vulnerabilities

eval() executes arbitrary code, making it vulnerable to code injection attacks.

unsafe use case:

let input = "alert('Hacked!')";
eval(input); // Executes malicious code

2. Performance Issues

eval() forces JavaScript to recompile code at runtime, slowing execution.
It prevents JavaScript engines from optimizing code effectively.

Safer Alternatives to eval()

1. Using JSON.parse() for JSON Data

let json = '{"city": "Mumbai", "population": 20400000}';
let obj = JSON.parse(json);
console.log(obj.city);

2. Using Function() Constructor

The Function constructor allows evaluating expressions safely.

let fn = new Function("a", "b", "return a + b;");
console.log(fn(10, 20));

3. Using Object Property Access

For dynamic property evaluation, use bracket notation instead of eval().

let obj = { language: "Hindi", spokenBy: "Millions" };
let key = "language";
console.log(obj[key]);

When to Avoid eval()

Avoid eval() in the following scenarios:

Processing user input.
Handling JSON data.
Accessing object properties dynamically.
Running frequently executed code (performance impact).