I don't have the book with me right now, but will check out page 155 when I get home. The key point with our use of eval is that it's part of Javascript. There isn't anything unique about how it works with ASP.NET AJAX. In the future, I expect that we will actually wrap our use of eval with a preliminary step that requires parsing the code first for additional security, but as it stands now, we simply use the script engine to eval the JSON as it is returned.
|