I've read this article about eval security issues.
I need a clarification about this particular situations:
For example, imagine we had a web app with a text field input that we were running eval() on. An attacker could easily run a script into your input field in order to perform a DOM Based XSS (cross site scripting) attack. This is an attack where malicious code is used to make the client-side DOM behave in an unexpected way, and therefore executes code differently within a user’s browser. This can be a route to render a malicious form into the page or redirect the user.
If i'm an attacker i could send my form with a malicious script as a value for that text field. The eval() call is in the javascript() on my browser. It isn't executed server side, how can it change internal application state?
I'm so confused :)
eval
function.