---
schema_version: "1"
id: e7298a10c3e300cea2b9b1d620d7a3153b1d8011938a540ac54494de20acbeda
title: Commerce Script Injection in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_commerce_script_injection.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_commerce_script_injection.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4be69cc5c4e5a73487608571bae267b2ed1c8cc49e584cf36c701877c967786a
description: Server script injection, or remote code execution, is a class of attack where maliciously crafted input is run in a privileged code execution context. This class of attack enables an attacker to control the code executed on the server.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Commerce Script Injection in B2C Commerce

Server script injection, or remote code execution, is a class of attack where maliciously crafted input is run in a privileged code execution context. This class of attack enables an attacker to control the code executed on the server.

Script injection is possible when a script interprets part or all of an unsafe or untrusted data input as code, or a snippet of code, and runs it. The most common error that results in code injection vulnerability is to call the global method `eval( string )` with an argument tainted with untrusted data. The `eval` method executes the passed string as a script expression. This method is deprecated. Avoid using it to prevent security risks.