Eval with stringified messages
HTML
<button id="doStuff">Do stuff</button>
JavaScript
$("#doStuff").click(function(){
// 1 - invalid due to string not being escaped = incorrect syntax
// this.eval("alert({"data": "blah"});");
// 2 - string escaped but not actually alerting a string as eval is turning the payload into a javascript object
window.eval("alert({\"data\": \"blah\"});");
// 3 - string doesnt need to be escaped as it is in single quotes
window.eval("alert('{\"data\": \"blah\"}');");
var stringified = JSON.stringify({something: "data"});
alert("Stringified is: " + stringified);
// Same result as 2
window.eval("alert(" + stringified + ");");
window.eval('alert(' + stringified + ');');
// Correct is
window.eval("alert('" + stringified + "');");
// Wont work, (yes this looks like the inverse of above so why shouldnt it work?)
// Well, the string itself contains double quotes so when it is executed it effectively looks like option 1
window.eval('alert("' + stringified + '");');
});