javascript - Difference between eval and window.json.parse for a dealing with a responseText? -

i have following code @ hand

var finalcompletedata = eval("("+jsonresponse.responsetext+")");

when used this, received security flaw error in fortify saying might lead javascript hacking. so, changed

var finalcompletedata = window.json.parse(jsonresponse.responsetext);

for this, fortify did not show error. window.json.parse method ?

can please explain. in advance :-)

eval execute javascript code supposed evaluate, , evaluates highest level of security. means if response text returns non-json code, valid javascript, eval execute it. sky limit this, can add new functions, change variables, redirect page.

with window.json.parse json evaluated, risk of rogue code getting entered much less.