Security risks of using eval() to execute user input in JavaScript
<p>I'm planning on throwing together a quick web page for my students to teach them about JavaScript programming. On this page, I'd like to give them a text box and allow them to run JavaScript so that they can see the dynamic nature of the language at work. However, I'm well aware that using eval() on user input is usually a really bad idea. What kind of security risks am I taking on by publishing a page like this? What steps should I take to mitigate these risks?</p>
