Tuesday, October 19, 2010

Is eval evil ?


var tact = (eval("args.S_TACT") == undefined ? "" : "S_TACT=" + eval("args.S_TACT"));


In this case it is really evil, and dangerous !
specially if args is "somehow built" from document.URL

For those interested: code comes from big blue web site.

No comments:

Post a Comment