 <p>It is hard to figure out exactly what you're really asking.</p> <p>Running <code>eval()</code> on user generated content (which it appears you are doing) does bring into play all sorts of security risks because it allows user generated code to be injected right into a context that it might not normally be able to get into. That is what it is and there is nothing you can do to change it. If you're going to run arbitrary user code (no matter how you do it), you will have this risk.</p> <p>What most sites that want to run arbitrary user generated code do is they fence off the user generated code in a different domain that due to the browser's cross-origin restrictions that domain that runs user generated code cannot freely access the rest of the page that is housed in some other domain and cannot freely access your main server. This gives you some protection. Look carefully at what jsFiddle does and you will see this technique being used as the user's code is served into an iframe from <code>http://fiddle.jshell.net</code> which is different than the other frames that make the site work which comes from <code>http://jsfiddle.net</code>. jsFiddle is also using some sandbox capabilities for the iframe.</p> <p>In the newest browsers you can also set up additional cross frame security restrictions with the <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox" rel="nofollow">sandbox capabilities</a> (newest generation browsers only).</p>