Is using javascript eval() safe for simple calculations in inputs?

Question

I would like to allow user to perform simple calculations in the text inputs, so that typing 2*5 will result in 10. I'm replacing everything but digits with an empty string and then make calculation using eval(). This seems easier and probably faster then parsing it manually.

It's often being said that eval() is unsafe, so I would like to hear is there any danger or drawback of using it in this situation.

function (input) {
  value = input.value.replace(/[^-\d/*+.]/g, '');
  input.value=eval(value);
}

And then you'll get people asking why 2+2e-3 results in 1 instead of 2.002. Warn the people about invalid input, don't silently throw it away. And try/catch the evaluation, so you can tell the user if it failed. — user1233508
– user1233508, Commented Dec 24, 2012 at 11:42

marcus erronius · Accepted Answer · 2012-12-24 11:39:28Z

13

That is safe, not because you are sanitizing it, but because it's all entered by the user and run in their own browser. If they really wanted to enter malicious code, they could do it anyway by using firebug or web inspector, or even using a bookmarklet. Thankfully, there isn't much you can do maliciously with javascript except lock up your own browser :)

answered Dec 24, 2012 at 11:39

marcus erronius

3,7031 gold badge20 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

GottZ · Accepted Answer · 2012-12-24 11:35:16Z

1

this is safe because you are doing input validation before you put it into eval.

besides you should also add:

()%

answered Dec 24, 2012 at 11:35

GottZ

4,9771 gold badge39 silver badges48 bronze badges

2 Comments

user1233508 Over a year ago

That's not validation, that's filtering.

Oskar Skuteli Over a year ago

I didn't add () because 1() would cause "is not a function" error in a console and i don't like to see this; also evaluation may fail due to mismatched braces. Though probably i should use try/catch. Thanks for the modulo and exponent from the other post.

Collectives™ on Stack Overflow

Is using javascript eval() safe for simple calculations in inputs?

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related