Hacker News Reader

Comment by winrid | Hacker News Reader

My personal career favorite use of eval was for an import system that "unrolled" the loop that went through the columns for each row, using eval. It was much faster, but obviously a huge security risk.

Today with modern JIT compilers its probably not much faster...

View on HN

I saw a very similar thing with eval. There was an evaluation of a nested JSON object

    x["a"]["b"]["c"]

And the developer decided that this was best evaluated by eval. During the code review phase I talked to them and asked why they were using eval, and they didn't know it could be evaluated directly as they were a little unclear if javascript supported that syntax.

How much longer did said dev continue working there?

Fire the dev, or educate the dev. Sure, eval is just a sure sign of a lot of lack of understanding, but I'd hope for something less vile as eval would be a little more understanding that everyone learns something sometime

It's gross negligence of the dev is only a Javascript dev, but maybe understandable if it's just one of the three languages he uses regularly. I probably wouldn't fire, but I also can't imagine any of my devs doing that.

err, no comment

that dev is now your manager? /s

He is the dev

LOL, no to both!

I was once tasked with creating a new frontend on an old project that had an API endpoint return something like this:

  var array = ["foo", "bar"]

I was expecting xml or json (like the rest of the endpoints), but I realized that they just served this as text, and then eval'd it on the frontend...

This was how you used to do it before JSON.parse was built into the browser.

it was literally a pseudo "standard":

https://en.wikipedia.org/wiki/JSONP

Right, but for it to be JSONP, the response should be injected into a script tag, I believe.

And it should be wrapped in a function call (most times, you can choose which function is called by a query parameter).

Reply on news.ycombinator.com