Is it wrong to post answers that uses eval()?
1 Answer
No, there’s nothing against site or network rules in suggesting eval()
in answers. Site rules do not dictate content; they dictate processes. The site rules only require that answers attempt to answer what’s in the question, not what the answers should contain.
And, by those lights, answers suggesting eval()
are still answers. They may be bad answers that expose readers who follow the advice to serious security risks¹, and therefore such answers may attract downvotes and criticism (which is precisely the purpose of downvotes: to warn or recommend against specific answers), but they’re answers nonetheless.
So go ahead, so long as you’re willing to accept the inevitable downvotes and critical comments.
¹: It might be nice if eval()
-suggesting answers clearly and unambiguously communicated these security risks, but again, there’s no rule saying you must; but it would provide some level of defense against the downvotes.
-
7@AnnZen If you don’t already know what the security risks are for
eval()
, that’s your problem right there.– Dan BronMay 23, 2020 at 19:58 -
3@AnnZen What research have you done about what problems eval might have? (Rhetorical.) (Such research was called for before posting your question here.)– philipxyMay 24, 2020 at 2:41
-
1OP is asking precisely because they are aware of the risks but they see it in answers– medic17May 25, 2020 at 16:29
-
@medic17 Meta is not the place to provide technical content. If OP wants to ask about the security risks of
eval()
, she should do so on Main. But the point is it is OP who is recommendingeval()
, as a solution, and the people asking questions she’s answering on SO are relying on her to have the appropriate technical expertise; it is her duty to ensure she provides all the relevant information in her answers. And no, OP is not “asking precisely because they are aware of the risks”: in comments, now deleted, it was clear that OP was completely unaware of said risks.– Dan BronMay 25, 2020 at 16:34
eval
in both JavaScript and Python (or any other form of runtime code parsing/execution) is a wrong answer... But it is not wrong to post wrong answers.