Close Advertisement
<script type="text/javascript">
//<![CDATA[
var obj = (function () {
var p = 'http://www.never-online.net';
return {
show: function() {
alert(p);
}
}
})();
obj.show(); //http://www.never-online.net
alert(obj.p); //undefined;
//]]>
</script>
//<![CDATA[
var obj = (function () {
var p = 'http://www.never-online.net';
return {
show: function() {
alert(p);
}
}
})();
obj.show(); //http://www.never-online.net
alert(obj.p); //undefined;
//]]>
</script>
以为上面的private变量会万无一失吗？如果你真的那样想，那么在下面的代码里，会让你大跌眼镜。在 firefox 里可以解开上面的闭包，答案是用eval
<script type="text/javascript">
//<![CDATA[
var obj = (function () {
var p = 'http://www.never-online.net';
return {
show: function() {
alert(p);
}
}
})();
obj.show(); //http://www.never-online.net
eval('p="eval you"', obj.show);
obj.show(); //eval you
//]]>
</script>
//<![CDATA[
var obj = (function () {
var p = 'http://www.never-online.net';
return {
show: function() {
alert(p);
}
}
})();
obj.show(); //http://www.never-online.net
eval('p="eval you"', obj.show);
obj.show(); //eval you
//]]>
</script>
是否觉得不得思议？eval是不是太不安全了，:)，且看mozilla的官方文档是怎么说的。以下是我截取的重点的部分
引用
[edit] Syntax
eval(string [, object])
[edit] Parameters
string
A string representing a JavaScript expression, statement, or sequence of statements. The expression can include variables and properties of existing objects.
object
Non-standard
An optional argument; if specified, the evaluation is restricted to the context of the specified object.
eval(string [, object])
[edit] Parameters
string
A string representing a JavaScript expression, statement, or sequence of statements. The expression can include variables and properties of existing objects.
object
Non-standard
An optional argument; if specified, the evaluation is restricted to the context of the specified object.
请再看下面一段
引用
Don't use eval!
eval() is a dangerous function, which executes the code it's passed with the privileges of the caller. If you run eval() with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage / extension.
There are safe alternatives to eval() for common use-cases.
eval() is a dangerous function, which executes the code it's passed with the privileges of the caller. If you run eval() with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage / extension.
There are safe alternatives to eval() for common use-cases.
对于eval，我们尽量少用，而且不用。如果要用，我会用在json的序列化和反序列化上。其它地方，能不用就不用。因为eval不光可以写，当然也可以读了，所以你整个代码对于eval来说都是可见的，没有了作用域，这就乱了
![[rolleyes]](styles/g/images/smilies/icon_rolleyes.gif){kind=icon}
[最后修改由 Rank, 于 2008-07-02 13:17:58]
评论Feed: http://www.never-online.net/blog/feed.asp?q=comment&id=224
貌似早版的FF，还有object.eval
现在的貌似没了。。。
搜__parent__时，见到不少有用object.eval方法的。。。
就像C++的private对象还可以指针运算修改呢
甚至C++的引用也是可以通过指针运算算出位置来修改的
FF一个非常别扭的做法是[[scope]]的优化 本来不止是函数 任何对象都可以这样做的 但是FF会把所有没用的（它认为没用的）[[scope]]给window
所以事情便乱了套
所以事情便乱了套
---------
IE也有类似的机制呀，所有无主的东西都给宿主window
所以事情便乱了套
---------
IE也有类似的机制呀，所有无主的东西都给宿主window