Take the 2-minute tour ×

i have a server message sent via web-sockets. that message is a json (validated) string. when it gets to the browser i check that it is a string with typeof(data) and it tells me that it is, in fact, a string. When finally i do var some_obj = eval( '(' + data + ')' ); it gives me an Uncaught SyntaxError: Unexpected token ILLEGAL error.

also, before using eval(), i console.log(data) and it displays correctly, although an alert(data) won't show anything on the dialog.

i can't understand what's happening.

i also tried var myJson = '{ "x": "Hello, World!", "y": [1, 2, 3] }'; and then var myObj = eval( '(' + myJson + ')' ); and it works, so i really can't understand why mine can't be evaluated (parsed).

the string received via web-sockets is this:

received 37 bytes » { "cmd": "setname", "params": "ok" }

where data = { "cmd": "setname", "params": "ok" } (with quotes i suppose, because of typeof(data) being = string).

any tips? thanks

edit1 » with web-sockets, you have to prepend a null char (0 ascii) and append a escape char (255 ascii) to the output string from the server. i assume the client (browser) as it implements web-sockets must deal with this and unwrap the string correctly (as the standard) and as i do in my server. thing is, there might be some escape char left and it doesn't deal with it correctly. but the problem only started when i tried to send json strings to be eval()ed. otherwise they work properly as any other string.

share|improve this question
You have to understand that the quotes at the beginning (and end) are only there for you and the parser to understand where a string begins (and ends). They are not actually part of the string itself. –  ZeissS Dec 19 '10 at 17:34
Are you sure typeof(data) is String? You don't mention console.log ing this. I think you'd get the beaviour you describe if data was an object literal and not in fact a string. –  Day Dec 19 '10 at 17:34
typeof(d) » string. Uncaught SyntaxError: Unexpected token ILLEGAL. there is actually something funny happening » when i try to copy from the console, the 'd' (string) with some text before, it doesn't copy... » console.log('received '+d.length+' bytes » ' + d); this is the log command and it generates » received 37 bytes » { "cmd": "setname", "params": "ok" } but i have to manually write it here because i'm not able to copy it! –  mwm Dec 19 '10 at 17:37

1 Answer 1

up vote 6 down vote accepted

No, there's no difference between " and ' for quoting strings other than that you can use " without escaping it inside a string quoted with ' and vice-versa. But I don't think that (the title of your question) actually has anything to do with the problem you're having.

Re your edit, if you want to ensure that there are no characters with the value 0 or 255 in the string, you can do that like this:

data = data.replace(/[\u0000\u00ff]/g, '');

...before passing it to eval. And it sounds like you might want to do that, since your thing is saying it's received 37 bytes but the string is only 36 characters long and doesn't use any characters requiring two bytes (or perhaps it just has a space at the end I can't see).

Off-topic: It's best not to use eval to deserialize JSON. Instead, use a library that handles it directly. Crockford has two different non-eval libs on his github page, one (json_parse.js) that uses a recursive-descent parser and another (json_parse_state.js) that uses a state machine. If you really, really want to use eval to parse JSON, take a look at his implementation in json2.js, which at least takes a couple of steps to weed out malicious stuff.

Off-topic 2: Re


We only use quotes to quote string literals in code; there are no quotes around actual string data itself in memory. If I do this:

var foo = "bar";

...the string that foo points to consists entirely of the characters b, a, and r. There are no quotes; the quotes are only there in the code to tell the parser that what follows is a string literal.

share|improve this answer
actually i'm not using eval(). i'm using json2.js with JSON.parse() but both give me the same result... i'll try your data.replace() thank you.EDIT » i did d = d.replace(/[\u0000-\u00ff]/g, ''); but now d is empty (0 length) but still typeof(d) = string –  mwm Dec 19 '10 at 18:00
@mwm: I'm afraid you saw an interim version where I'd typed - where I shouldn't have. The correct regex is (now) shown above (just delete the -). :-) V. embarrassing, I kind of hoped I'd caught it before anyone saw it, but apparently not. –  T.J. Crowder Dec 19 '10 at 18:04
well i should learn some regex too. thank you. that actually worked! which means that i was right, supposing some web-sockets implementation chars were conflicting. i thought the browser unwraped the string correctly. thank you very much @T.J. Crowder –  mwm Dec 19 '10 at 18:09
@mwm: No worries, glad that did it. Are you quite sure that this 0 and 255 thing is really required by the web sockets stuff? I'm not seeing it: dev.w3.org/html5/websockets/#dom-websocket-send It would be pretty retrograde to require doing that. If you're explicitly doing that, I can recommend trying not doing it and seeing if things still work? I have this suspicion you're doing work that the underlying implementation is supposed to do (and is probably doing, duplicating your efforts). –  T.J. Crowder Dec 19 '10 at 18:14
@T.J.Crowder Thank you! Your answer helped a lot. I too had a '\0' at the end of a JSON string sent over a websocket. Note to C++ coders: don't use std::ends to end your std::ostringstream! –  Eric Sellin Oct 17 '12 at 20:58

Your Answer


