The client doesn't send code to the server, just a JSON representation of the function arguments (which can include names of client-side callback functions). There's no eval.