How to execute script from an Input field on JS?

Question

I want to execute script from an editable input field when clicking a button

for example, If you type "alert("x");", I want to alert you "x", but also if you type "for(i=0;i<3;i++){alert(i);}" I want it to execute it.

How can I achieve this?

Edit: eval() is the only solution? Because I read that it is dangerous: https://developer.mozilla.org/en/JavaScript/Reference/Global_Objects/eval#section_5

Remember to be very careful when doing this. Be sure you trust your users, as all kinds of malicious javascript could be entered. — Brian Ramsay
– Brian Ramsay, Commented Nov 7, 2011 at 20:14
That's true, I just read something when researching about eval() developer.mozilla.org/en/JavaScript/Reference/Global_Objects/… — ajax333221
– ajax333221, Commented Nov 7, 2011 at 20:16

Pavel Podlipensky · Accepted Answer · 2011-11-07 20:11:29Z

Please note that you're taking input from the user and running it in the context of a script on your site. So the script can do anything that JavaScript running on your browser/domain would have the ability to do (including cookie stealing, XSS, drive-by malware, etc.).

The only thing you can realistically do to mitigate the risks is to not eval() user-provided content. I'd suggest to consider the following alternatives:

Use iframe as an environment to run user's script: http://dean.edwards.name/weblog/2006/11/sandbox/
Use Caja. It allows websites to safely embed DHTML web applications from third parties, and enables rich interaction between the embedding page and the embedded applications. It uses an object-capability security model to allow for a wide range of flexible security policies. http://code.google.com/p/google-caja/

Happy coding!

Ruslan · Accepted Answer · 2011-11-07 19:50:21Z

1

Try this one :) http://www.w3schools.com/jsref/jsref_eval.asp

answered Nov 7, 2011 at 19:50

Ruslan

3,1283 gold badges24 silver badges25 bronze badges

1 Comment

John Munsch Over a year ago

Try to avoid sending people to w3schools docs if at all possible. Here's some info on eval at MDN: developer.mozilla.org/en/JavaScript/Reference/Global_Objects/… If you're curious why I say this, this site (though perhaps a little strident) sums it up: w3fools.com

angelfilm entertainment · Accepted Answer · 2011-11-07 19:50:53Z

1

Use the eval() command and it will evaluate and execute the javascript you pass to it.

answered Nov 7, 2011 at 19:50

angelfilm entertainment

1,1632 gold badges15 silver badges31 bronze badges

Comments

pomaxa · Accepted Answer · 2011-11-07 19:51:11Z

0

use eval, like onclick="eval(document.getElementById('your_input'))"

answered Nov 7, 2011 at 19:51

pomaxa

1,74616 silver badges26 bronze badges

Collectives™ on Stack Overflow

How to execute script from an Input field on JS?

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related