blocks|key|1174898|text|JSON只是JavaScript的一个子集。但是eval会评估整个JavaScript语言，而不仅仅是JSON的子集。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1174899|entityMap^0|O|4|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

JSON is just a subset of JavaScript. But <code>eval</code> evaluates the full JavaScript language and not just the subset that’s JSON.

blocks|key|1174975|text|如果您使用eval解析JSON，您将允许解析的字符串包含任何内容，因此，您可能会发现自己正在执行函数调用或其他任何东西，而不仅仅是一组数据。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1174976|此外，JSON的parse接受一个附加参数reviver，该参数允许您指定如何处理某些值，例如datetimes+(在内联文档here中有更多信息和示例)|1174977|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/douglascrockford/JSON-js^0|5|4|0|8|5|1R|4|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@$9|V|A|W|1|X]]|E|$]]|$1|H|3|-4|5|6|7|Y|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

If you parse the JSON with <code>eval</code>, you're allowing the string being parsed to contain absolutely anything, so instead of just being a set of data, you could find yourself executing function calls, or whatever. 

Also, JSON's <code>parse</code> accepts an aditional parameter, reviver, that lets you specify how to deal with certain values, such as datetimes (more info and example in the inline documentation <a href="https://github.com/douglascrockford/JSON-js" rel="noreferrer">here</a>)

blocks|key|1175027|text|并非所有浏览器都支持原生JSON，因此有时需要对JSON字符串使用eval()。使用http://json.org中的JSON解析器，因为它可以更轻松地处理所有事情。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1175028|Eval()是一个邪恶的东西，但对于某些浏览器来说，它是一个必要的邪恶，但在你可以避免它的地方，就这么做吧！|1175029|entityMap|0|LINK|mutability|MUTABLE|url|http://json.org/^0|X|6|16|F|0|0|0|6|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@$9|S|A|T|1|U]]|E|$]]|$1|F|3|G|5|6|7|V|8|@$9|W|A|X|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|Y|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

Not all browsers have native JSON support so there will be times where you need to use <code>eval()</code> to the JSON string. Use JSON parser from <a href="http://json.org" rel="noreferrer">http://json.org</a> as that handles everything a lot easier for you.

<code>Eval()</code> is an evil but against some browsers its a necessary evil but where you can avoid it, do so!!!!!

blocks|key|1390516|text|所有JSON.parse实现都很可能使用eval()|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1390517|JSON.parse基于Douglas+Crockford's+solution，它在line+497上使用了eval()。|1390518|//+In+the+third+stage+we+use+the+eval+function+to+compile+the+text+into+a
//+JavaScript+structure.+The+'{'+operator+is+subject+to+a+syntactic+ambiguity
//+in+JavaScript:+it+can+begin+a+block+or+an+object+literal.+We+wrap+the+text
//+in+parens+to+eliminate+the+ambiguity.

j+=+eval('('+%2B+text+%2B+')');|code-block|syntax|javascript|1390519|JSON.parse的优点是它验证了参数是否正确。|1390520|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/douglascrockford/JSON-js/blob/master/json2.js|1|https://github.com/douglascrockford/JSON-js/blob/107fc93c94aa3a9c7b48548631593ecf3aac60d2/json2.js#L491^0|2|A|K|6|0|0|A|1J|6|C|S|0|17|8|1|0|0|0|A|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]|$9|16|A|17|B|C]]|D|@$9|18|A|19|1|1A]|$9|1B|A|1C|1|1D]]|E|$]]|$1|H|3|I|5|J|7|1E|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1F|8|@$9|1G|A|1H|B|C]]|D|@]|E|$]]|$1|O|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]|W|$5|R|S|T|E|$U|X]]]]

All <code>JSON.parse</code> implementations most likely use <code>eval()</code>

<code>JSON.parse</code> is based on <a href="https://github.com/douglascrockford/JSON-js/blob/master/json2.js" rel="noreferrer">Douglas Crockford's solution</a>, which uses <code>eval()</code> right there on <a href="https://github.com/douglascrockford/JSON-js/blob/107fc93c94aa3a9c7b48548631593ecf3aac60d2/json2.js#L491" rel="noreferrer">line 497</a>.

<pre><code>// In the third stage we use the eval function to compile the text into a
// JavaScript structure. The '{' operator is subject to a syntactic ambiguity
// in JavaScript: it can begin a block or an object literal. We wrap the text
// in parens to eliminate the ambiguity.

j = eval('(' + text + ')');
</code></pre>

The advantage of <code>JSON.parse</code> is that it verifies the argument is correct JSON syntax.

blocks|key|1390582|text|JSON.parse()和eval()接受的内容是不同的。对此尝试eval：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1390583|var+x=+"{\"shoppingCartName\":\"shopping_cart:2000\"}“|1390584|eval(x)+++++++++//won't+work
JSON.parse(x)+++//does+work|code-block|syntax|javascript|1390585|请参阅此example。|offset|length|1390586|entityMap|0|LINK|mutability|MUTABLE|url|http://jsfiddle.net/jlowery2663/gSAS3/^0|0|0|0|4|7|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@$K|Y|L|Z|1|10]]|A|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]]]

There is a difference between what JSON.parse() and eval() will accept. Try eval on this:

var x = "{\"shoppingCartName\":\"shopping_cart:2000\"}"

<pre><code>eval(x) //won't work
JSON.parse(x) //does work
</code></pre>

See this <a href="http://jsfiddle.net/jlowery2663/gSAS3/" rel="noreferrer">example</a>.

My Spider Sense warns me that using <code>eval()</code> to parse incoming JSON is a bad idea. I'm just wondering if <code>JSON.parse()</code> - which I assume is a part of JavaScript and not a browser-specific function - is more secure.

JSON.parse vs. eval()

JSON

我的Spider Sense警告我，使用eval()来解析传入的JSON不是一个好主意。我只是想知道JSON.parse() -我假设它是JavaScript的一部分，而不是特定于浏览器的函数-是不是更安全。

问JSON.parse与eval()
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问JSON.parse与eval()EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问JSON.parse与eval()
EN