I have a website into which a user enters a line equation (such as y=2x+5) and it displays the equation to them.
Currently, to plot the equation I'm simply running eval()
on the input string, like this:
for (x = 0; x < max; x++) {
y = eval(equation)
values.push([x, y]);
}
Are there any security implications along with this? The results are neither stored anywhere on my server or shown to other users - so is this just the same as somebody typing a command into the command prompt, or could they do something else bad?