title: Exploiting JavaScript's eval() method
body: <p>Many developers believe that JavaScript's <code>eval()</code> method should be avoided. This idea makes sense from a design perspective. It is often used as an ugly workaround when a simpler, better option is available.</p>
  
  <p>However, I do not understand the concerns about security vulnerabilities. Certainly, running <code>eval()</code> gives the hacker the ability to run any JavaScript code that you can run.</p>
  
  <p>But can't they do this anyway? In Chrome, at least, the Developer Tools allow the end-user to run their own JavaScript. How is <code>eval()</code> more dangerous than the Developer Tools?</p>