Re:Server-Side JavaScript Injection
by kevincennis on Friday October 19, 2012 @01:53PM
(#4674636)
All I'm saying is that if I'm putting together a quick demo or proof of concept or reduced test case, I'm always going to favor "easy" over "secure". And sometimes using eval is easier.
By the way, the performance of evaling an array that way is abysmal: http://jsperf.com/array-summing-loop-vs-eval