setTimeout With A String

browser tricks 1996 partly

setTimeout originally took a string of source code, which it compiled and ran when the timer fired. eval with a fuse.

In 2026: Partly. The string form is still valid and still fires on a page with no Content Security Policy. But a CSP without unsafe-eval blocks it exactly like eval, and this page sets one, so the demo fires the function form and shows the string form as text. Function arguments arrived in JavaScript 1.2 and won completely.

Where it came from: JavaScript 1.0 setTimeout, Netscape 2, 1996, which accepted only strings. Function arguments came with JavaScript 1.2. MDN ↗

<p id="g">Wait for it...</p>
<p id="note"></p>

<script language="JavaScript">
var visitor = "friend";
// The function form fires normally, a moment after load.
setTimeout(function () {
  document.getElementById("g").innerHTML =
      "Hello, " + visitor + "! Fired a second later, from a function.";
}, 1200);

// The original string form,  setTimeout("greet()", 1200),  is still valid
// JavaScript. A Content Security Policy with no 'unsafe-eval' blocks it like
// eval, so this page cannot fire it.
document.getElementById("note").innerHTML =
    "The STRING form runs on any page without a Content Security Policy. " +
    "This page has one, so the string form is blocked, the same as eval.";
</script>

sandboxed demo · breaks nothing but itselfrestart

More in browser tricks