Geek asks and answers

In this limited setting, can eval () cause security issues?

I am writing a website that will include some math exercises. I don’t care if users try to cheat, so I fix the answers through Javascript

In my particular case, I have a field in the form. I would like to allow the user to enter a mathematical expression (say 3/2) and use his result to find out if he is right. For this, I would use eval.

My javascript would never read directly from the url, just from the form. No results from this page will ever be stored for display to any user (perhaps we will save the results for statistical analysis later, then storing them in the database via PHP, but again, I probably need to sanitize any input in PHP itself, from -for the fear of users using POST directly)

Whatever happens? = P

+5
source share
2 answers

You would like to be sure that in eval, which could potentially break the script (it can be intentional or unintentional - not an attack, but a user error), an illegal will occur. I would say either check the field before eval to make sure it is arithmetic and the only way.

, eval . , , .

Javascript Expression Evaluator eval

+4

?

Javascript - , , . , , , . Javascript, , .

, , , , , . , , , , , , .

+2

More articles:


All Articles