Is the use of window.location.href("javascript://code"); just as bad as eval?

Question

For instance:

    eval("alert('Hello there!');");

    // is just as bad as?

    window.location.href = "javascript:alert('Hello there!');void(0);";

Who are we to judge what's good and what's bad? Yes, it's just as bad. — Julien Lebosquain, Nov 09 '12 at 07:55
You killed the sweet ethics of javascript !! No offence ! :) — coolguy, Nov 09 '12 at 07:57

score 3 · Accepted Answer · edited May 23 '17 at 11:56

3

Yeah, that's the same : the string after "javascript:" is evaluated to be executed.

At least the first bad solution is more direct and obvious...

For a more general insight about why eval is evil, I'd redirect you to this other SO question.

But why would you use this kind of things ? It's very very hard to find a legitimate case where it would simplify your code.

edited May 23 '17 at 11:56

Community

answered Nov 09 '12 at 07:55

Denys Séguret

1 Answers1