Right - eval gets passed String objects. So before the eval is called, json is a variable which references a String.
After the eval, the variable foo refers to a Javascript Object.
However,
@unknownuser said:
To convert a JSON text into an object, you can use the eval() function. eval() invokes the JavaScript compiler. Since JSON is a proper subset of JavaScript, the compiler will correctly parse the text and produce an object structure. The text must be wrapped in parens to avoid tripping on an ambiguity in JavaScript's syntax.
var myObject = eval('(' + myJSONtext + ')');
and
@unknownuser said:
..If the server is not rigorous in its JSON encoding, or if it does not scrupulously validate all of its inputs, then it could deliver invalid JSON text that could be carrying dangerous script. The eval function would execute the script, unleashing its malice.
To defend against this, a JSON parser should be used. A JSON parser will recognize only JSON text, rejecting all scripts. In browsers that provide native JSON support, JSON parsers are also much faster than eval. It is expected that native JSON support will be included in the next ECMAScript standard.
var myObject = JSON.parse(myJSONtext, reviver);
I believe Chris is using json2.js on my recommendation, which is based on DC's recommendation because it is possible CG's data could come from an outside source.
And I would also repeat what TBD said and watch the "Good Stuff" video - at least you will know what to avoid in Javascript to make your life easier.
Offline
