Why is eval unsafe in javascript? [duplicate]

Possible Duplicate:
Why exactly is eval evil?

I read people claim that eval is unsafe when run on arbitrary user input code. I understand this in other languages that run on the server that access the filesystem, etc. However, why does this matter when executing code in a browser? After all, can't you just fire up Firebug and write any arbitrary script you want anyway? So then how is eval any different?

Solution 1:

The danger of eval only rears its ugly head when you are serving a script written by alice to user bob for bob's browser to eval.

e.g. if bob enters his password on your page, alice could have written a keylogger in the user input you evaled and arrange for the data to be encoded in a script that bob will (unknowingly) submit to be served to alice. This is, as @Hunter2 has suggested in the comments, an XSS attack.

If you are not serving to other people, you are correct in assuming it is equivalent to firing up firebug

Solution 2:

don't think it is unsafe, for the most paranoid execute eval = null;