title: How does jsFiddle allow and execute user-defined JavaScript without being dangerous?
body: <p>I've been working on a JS library and would like to setup a demo page on Github that allows, for example, users to define their own callbacks and execute commands. </p>
  
  <p>I know "<code>eval()</code> is evil" and I can see how blind <code>eval()</code> of scripts could lead to XSS and other security issues. I'm trying to cook up some alternative schemes.</p>
  
  <p>I really enjoy the interactivity of jsFiddle. I've taken a look at their source but was hoping someone could lay out here how jsFiddle allows and executes user-defined JavaScript without being dangerous. So long as it doesn't involve a 3rd party echo server, I'm hoping I can emulate the approach.</p>