Dangerous JavaScript Functions
Dangerous JavaScript functions like eval(), document.write(), and innerHTML can introduce DOM-based XSS vulnerabilities when used with untrusted input.
Why It Matters
DOM-based XSS through dangerous functions is harder to detect than reflected XSS and bypasses server-side sanitization. Attackers can execute arbitrary code in the user's browser context.
How We Check
We scan inline scripts and event handler attributes for calls to eval(), document.write(), innerHTML assignments, new Function(), and string-based setTimeout/setInterval.
How to Fix
Replace eval() with JSON.parse(). Use textContent instead of innerHTML. Use DOM APIs (createElement, appendChild) instead of document.write(). Implement Trusted Types via CSP.
Related Security Checks
Check Your Website Now
Run a free security scan to check for Dangerous JavaScript Functions issues and 58+ other security vulnerabilities.
Scan Your Website Free