Analysis of precautions for using eval to parse JSON in JS_javascript skills

This article analyzes in detail the precautions for using eval to parse JSON in JS. Share it with everyone for your reference, the details are as follows:

There are generally two ways to parse JSON strings into JSON data format in JS:

1. One is to use the eval() function.

2. Use Function object to perform return analysis.

Use the eval function to parse, and use jquery's each method to traverse

Use jquery to parse JSON data. As the transmission object of jquery asynchronous request, the result returned after jquery request is json object. What is considered here is the form of string returned by the server in JSON form. For encapsulation using plug-ins such as JSONObject The JSON object is similar to this and will not be explained here.

The JSON string set is first given here. The string set is as follows:

The code is as follows:

var data="
{
root:
[
{name:'1',value:'0'},
{name:'6101',value:'北京市'},
{name:'6102',value:'天津市'},
{name:'6103',value:'上海市'},
{name:'6104',value:'重庆市'},
{name:'6105',value:'渭南市'},
{name:'6106',value:'延安市'},
{name:'6107',value:'汉中市'},
{name:'6108',value:'榆林市'},
{name:'6109',value:'安康市'},
{name:'6110',value:'商洛市'}
]
}";

Based on the data types obtained asynchronously by jquery - json objects and strings, here we introduce the processing methods of the results obtained in the two ways.

1. For the JSON string returned by the server, if the jquery asynchronous request does not have a type description, or is accepted as a string, then it needs to be objectified. The method is not too troublesome, that is, put the string in eval () is executed once. This method is also suitable for obtaining json objects using ordinary javascipt. The following is an example:

var dataObj=eval("("+data+")");//转换为json对象
Red rose为什么要 eval这里要添加 “("("+data+")");//”呢？

The reason is: the problem of eval itself. Since json starts and ends with "{}", it will be processed as a statement block in JS, so it must be forced to be converted into an expression.

The purpose of adding parentheses is to force the eval function to convert the expression in the parentheses into an object instead of executing it as a statement when processing JavaScript code. For example, if the object literal {} is not added with outer brackets, then eval will recognize the braces as the start and end marks of the JavaScript code block, and {} will be considered to execute an empty statement. So the following two execution results are different:

alert(eval("{}"); // return undefined
alert(eval("({})");// return object[Object]

This kind of writing can be seen everywhere in JS.

For example: (function()) {}(); When doing closure operations, etc.

alert(dataObj.root.length);//输出root的子对象数量 
$.each(dataObj.root,fucntion(idx,item){ 
if(idx==0){ 
return true; 
} 
//输出每个root子对象的名称和值 
alert("name:"+item.name+",value:"+item.value); 
})

Note: For general js to generate json objects, you only need to replace the $.each() method with a for statement, and the others remain unchanged.

2. For the JSON string returned by the server, if the jquery asynchronous request sets the type (usually this configuration attribute) to "json", or uses the $.getJSON() method to obtain the server return, then there is no need to eval ( ) method, because the result obtained at this time is already a json object, you only need to call the object directly. Here, the $.getJSON method is used as an example to illustrate the data processing method:

$.getJSON("http://www.phpzixue.cn/",{param:"gaoyusi"},function(data){ 
//此处返回的data已经是json对象 
//以下其他操作同第一种情况 
$.each(data.root,function(idx,item){ 
if(idx==0){ 
return true;//同countinue，返回false同break 
} 
alert("name:"+item.name+",value:"+item.value); 
}); 
});

What needs special attention here is that the eval() method in method 1 dynamically executes the string (possibly a js script), which can easily cause system security issues. Therefore, you can use some third-party client script libraries that circumvent eval(). For example, JSON in JavaScript provides a script library of no more than 3k.

The second parsing method is to use Function objects. Its typical application is the parsing of returned data such as success under the AJAX method in JQUERY

var json='{"name":"CJ","age":18}';
data =(new Function("","return "+json))();

The data at this time is a json object that will be parsed.

I hope this article will be helpful to everyone in JavaScript programming.