I have a website into which a user enters a line equation (such as y=2x+5) and it displays the equation to them.

Currently, to plot the equation I'm simply running eval() on the input string, like this:

for (x = 0; x < max; x++) {
  y = eval(equation)
  values.push([x, y]);

Are there any security implications along with this? The results are neither stored anywhere on my server or shown to other users - so is this just the same as somebody typing a command into the command prompt, or could they do something else bad?

  • Eval could be used as a Cross site scripting attack against someone, medium.com/@eric_lum/…
    – Dijkgraaf
    May 15 at 4:03
  • @Dijkgraaf I don’t think that let’s the user do anything that they can’t by just opening the developer tools
    – Tim
    May 16 at 8:29
  • It won't be the user that browses to your site, it would be someone else attacking that user, using a Cross Site Scripting attack. See security.stackexchange.com/questions/94017/…
    – Dijkgraaf
    May 16 at 20:44
  • @Dijkgraaf does that apply in my situation? There’s no persistent storage shared between users.
    – Tim
    May 17 at 21:16
  • Yes, cross site scripting doesn't require persistent storage.
    – Dijkgraaf
    May 18 at 11:57

2 Answers 2


Depends on what they can do really.

  • Like if it's just an input that displays something on a button press, then not really all that much. At least not anything they couldn't do with devtools.

  • If it's something that then gets sent to a server, saved, and displayed for themselves then again there aren't really much harm they'd be able to do.

  • If it's sent to the server and shown for other people, then they'd be able to do a lot of harm

But why not use something like algebra.js, which can both parse and evaluate expressions?


The eval can't cause anything unusually or exceptionally bad for the server. The server needs to be protected from arbitrary data being sent to it from potentially malicious HTTP(S) clients anyways. However, the eval can be easily abused to temporarily deface the site (only in the user's browser). You may want to implement some kind of filtering on the eval to guard against such pranks.

  • Whilst this is true, it is also true to say that most browsers now have an accessible "developer console" that can be used for exactly the same purpose. This sort of behaviour can't be stopped and implementing filtering on the eval statement is more likely to introduce bugs than impact (true) security. Nov 24, 2016 at 11:20
  • If someone wants to deface the site in their own browser, they can open up the developer tools and do it from there (probably more convenient anyway). Nov 24, 2016 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .