浏览器中执行字符串代码的可行方法（含非标准）有哪些？

Great question! Let's walk through all the ways you can execute string-based code in browsers—covering the ones you already know, your hunch about setImmediate, plus some lesser-known and non-standard options:

Standard Methods #

These are widely supported and documented in official specs:

• eval()
  The most direct way to execute string code, running it in the current lexical scope (not global). It has full access to variables in the surrounding context.

  const message = "Hello from eval";
  eval('console.log(message)'); // Logs "Hello from eval"
  

  Note: Direct eval() is scoped, but if you assign it to a variable (e.g., const myEval = eval; myEval('...')), it runs in the global scope instead.

• Function Constructor
  Creates a new function from a string, which you can then invoke. Unlike eval(), it runs in the global scope by default (it doesn't inherit the surrounding lexical scope).

  // Basic execution
  new Function('console.log("Hello from Function constructor")')();
  
  // With parameters
  const add = new Function('a', 'b', 'return a + b');
  console.log(add(2, 3)); // Logs 5
  

• Timer Functions (setTimeout/setInterval)
  Both accept a string as their first argument, which gets executed in the global scope after the specified delay (or interval).

  setTimeout('console.log("Hello from setTimeout")', 0);
  setInterval('console.log("Hello from setInterval")', 1000); // Runs every second
  

• setImmediate()
  Your hunch is correct! Even though some docs don't explicitly call out the string parameter, all modern browsers that support setImmediate() (Chrome, Edge, etc.) allow passing a string, which executes in the global scope—just like setTimeout with a 0ms delay.

  setImmediate('console.log("Hello from setImmediate")');
  

  Note: setImmediate() is not part of the official ECMAScript spec, but it's a de facto standard in many browsers.

Non-Standard/Edge Cases #

These methods are either deprecated, browser-specific, or not part of official specs:

• execScript()
  A legacy IE-specific method that executes string code in the global scope. It's long deprecated, but you might encounter it in older codebases.

  // Only works in old IE versions
  execScript('console.log("Hello from execScript")');
  

• Dynamic <script> Tags
  While technically standard, this is a roundabout way to execute string code by injecting it into the DOM. The code runs in the global scope as soon as the script element is added to the page.

  const script = document.createElement('script');
  script.textContent = 'console.log("Hello from dynamic script")';
  document.body.appendChild(script);
  

• window.eval()
  A variant of eval() that explicitly runs code in the global scope, even when called inside a function. This is standard behavior, but it's a lesser-known quirk of how eval works.

  const globalVar = "Global value";
  function test() {
    const localVar = "Local value";
    eval('console.log(localVar)'); // Logs "Local value" (current scope)
    window.eval('console.log(globalVar)'); // Logs "Global value" (global scope)
  }
  test();
  

• Web Workers (Indirect Execution)
  You can send a string of code to a Web Worker, which can then use eval() to run it. The code runs in the Worker's isolated global scope, not the main thread's.

  // Create a worker that listens for code strings
  const worker = new Worker(URL.createObjectURL(new Blob([
    'self.onmessage = (e) => eval(e.data);'
  ])));
  
  // Send code to execute
  worker.postMessage('console.log("Hello from Worker eval")');
  

Critical Notes #

• Security Risk: All methods that execute string code are vulnerable to XSS attacks if the string contains untrusted content (e.g., user input). Never run code from sources you don't fully trust.
• Performance: JS engines can't optimize string-based code the way they optimize static code, so these methods are generally slower than writing regular JS.
• Maintainability: String code is harder to debug, read, and maintain than standard JS. Avoid using these methods unless absolutely necessary.

内容的提问来源于stack exchange，提问作者Estus Flask