What are the potential consequences of evaluating user input with client side JavaScript?

Question

I have a website into which a user enters a line equation (such as y=2x+5) and it displays the equation to them.

Currently, to plot the equation I'm simply running eval() on the input string, like this:

for (x = 0; x < max; x++) {
  y = eval(equation)
  values.push([x, y]);
}

Are there any security implications along with this? The results are neither stored anywhere on my server or shown to other users - so is this just the same as somebody typing a command into the command prompt, or could they do something else bad?

Answer 1

The eval can't cause anything unusually or exceptionally bad for the server. The server needs to be protected from arbitrary data being sent to it from potentially malicious HTTP(S) clients anyways. However, the eval can be easily abused to temporarily deface the site (only in the user's browser). You may want to implement some kind of filtering on the eval to guard against such pranks.