Trying to avoid javascript eval()

Question

Let's say I want to add variable interpolation to String like so:

String.prototype.interpolate = function() { return this.replace(/{(\S+?)}/g, function(match, $1) {return eval($1);}); }

If all of my variables are global or local then I could replace eval($1) with this[$1]. However if I've got something like var name = {first: 'Joe', last: 'Blogs'}; then this[$1] will not work to interpolate "Hello, {name.first} {name.last}!".interpolate(). Is there anything I could use in place of eval()? If I'm expecting those variables to come from an untrusted source then I really cannot use eval().

You should use some little templating engine. Read about ejohn.org/blog/javascript-micro-templating it's quite small and tricky :) — biziclop
– biziclop, Commented Mar 16, 2012 at 21:23

abesto · Accepted Answer · 2012-03-16 21:25:02Z

1

If you don't want to use a pre-existing template engine, I'd suggest making the data to interpolate explicit:

String.prototype.interpolate = function(data) { return this.replace(/{(\S+?)}/g, function(match, $1) {return data[$1];}); } console.log( '{a} is better than {b}'.interpolate({'a':'explicit', 'b':'implicit'}) );

answered Mar 16, 2012 at 21:25

abesto

2,35117 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Christopher Weiss Over a year ago

@biziclop: That micro-templating stuff is pretty nice but not usable under 'use strict'; conditions since it uses with.

Christopher Weiss Over a year ago

abesto: That certainly works but seems to violate the principle of Don't Repeat Yourself.

abesto Over a year ago

@ChristopherWeiss: only if the parameter is built in place like this. In a good number of cases it'll be available in a pre-existing object.

Collectives™ on Stack Overflow

Trying to avoid javascript eval()

1 Answer 1

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Related