+1 evil.<p>After spending years telling us <i>not</i> to use eval() to execute raw JSON, now we are suppose to eval() <i>comments?</i>  As noted with JSON, theoretically it can be used safely, but it is a wide open window of vulnerability for people "just trying to get it done", i.e. 97% of the web sites out there.<p><a href="http://en.wikipedia.org/wiki/JSON#Security_issues" rel="nofollow">http://en.wikipedia.org/wiki/JSON#Security_issues</a><p>"The eval technique is subject to security vulnerabilities if the data and the <i>entire JavaScript environment</i> is not within the control of a single trusted source. If the data is itself not trusted, for example, it may be subject to malicious JavaScript code injection attacks; unless some additional means is used to validate the data first."<p>(My emphasis on <i>entire JavaScript environment.</i>)