jQuery.globalEval(code) (alias $.globalEval) executes a JavaScript string in the global scope (since jQuery 1.0.4). Unlike eval(), declarations become true globals — important when loading scripts dynamically.
Pass a trusted code string; optionally add CSP nonce or a target document.
Start with a trusted JavaScript string (never user input).
Call $.globalEval(code) so var / function declarations land on the global object.
On CSP sites (jQuery 3.4+), pass { nonce: "..." } as the second argument.
For iframes (jQuery 3.5+), pass the iframe’s contentDocument as the third argument.
Piece
Required?
Role
code
Yes
JavaScript string to execute globally
options.nonce
No (3.4+)
CSP nonce for the injected script
doc
No (3.5+)
Document whose global context runs the code
Return
—
Result of the last expression (Anything)
Pseudocode
Pseudocode
function globalEval(code, options, doc):
targetDoc = doc or current document
// run code in targetDoc's global scope
// (not the calling function's local scope)
return result of last expression
// Official pattern:
function test():
$.globalEval("var newVar = true;")
test()
// newVar is now a global → true
Reference
Cheat Sheet
Keep these facts handy while working with global script strings.
Second argument. Pass a plain object with nonce (jQuery 3.4+).
CSP match. The value must match your page’s Content-Security-Policy nonce.
Same global result. The string still runs globally — cspVar becomes true.
This demo. No CSP header here; the option is shown for real locked-down sites.
Edge Cases & Pitfalls
Check these before evaluating dynamic script strings.
security
Untrusted strings = XSS
Treat globalEval like running raw code. Never pipe form fields, URL params, or third-party HTML into it.
scope
let / const are not window props
Global var and function attach to window. Top-level let/const in script scope behave differently — prefer explicit window.name = ... when you need a clear global.
csp
Strict CSP needs a nonce
Without a matching nonce, browsers may block the injected script. Pass { nonce } on jQuery 3.4+ when your policy requires it.
prefer
Prefer modules or getScript
For remote files use $.getScript(). For modern apps, ES modules are clearer than string evaluation.
Compatibility
Browser Support
jQuery.globalEval() needs a browser document. Available since jQuery 1.0.4+ (nonce in 3.4+, doc in 3.5+) in all modern browsers — not for Node.js, Bun, or Deno.
✓ jQuery 1.0.4+ · Browsers only
jQuery.globalEval()
Works in Chrome, Firefox, Safari, Edge, and other browsers with jQuery loaded. Use nonce (3.4+) and doc (3.5+) only on matching jQuery versions.
100%Browser support
Google ChromeAll versions · Desktop & Mobile
Full support
Mozilla FirefoxAll versions · Desktop & Mobile
Full support
Apple SafariAll versions · macOS & iOS
Full support
Microsoft EdgeAll versions · Chromium & Legacy
Full support
Internet ExplorerIE 6+ · Legacy environments
Full support
OperaAll modern versions
Full support
$.globalEval()Browsers
Bottom line: Use $.globalEval(code) in the browser with trusted strings only. Load remote scripts with $.getScript() when you have a URL.
Analysis
Performance Notes
Approach
Cost
Best for
$.globalEval(code)
Parse + run once
Small trusted snippets
Repeated globalEval
Re-parse each time
Avoid in hot loops
$.getScript(url)
Network + parse
External .js files
Parsing a string every time is slower than calling a normal function. Evaluate once, then call the globals you defined — do not re-run large strings on every click or animation frame.
Remember
Key Takeaways
Role:$.globalEval(code) runs a string in global scope.
vs eval: globals survive; eval locals do not.
CSP: pass { nonce } on jQuery 3.4+ when required.
Safety: trusted code only — never user input.
One line: use $.globalEval only for trusted script strings that must become true globals — prefer $.getScript or modules when you can.
Frequently Asked Questions
jQuery.globalEval(code) executes a string of JavaScript in the global scope — the same context as scripts in the page. Variables and functions declared with var or function in that string become globals (on window in browsers).
eval() runs in the current lexical scope, so var declarations inside a function stay local. globalEval() always runs in the global context, which matters when dynamically loading scripts that must define window-level APIs.
jQuery uses it when processing inline script tags inserted through DOM APIs — for example .html() or .append() with script blocks — so those scripts run globally like normal page scripts.
No. Never pass untrusted strings — it runs arbitrary code and enables XSS. Only use trusted, server-controlled script content. Prefer $.getScript() for remote files or ES modules for modern apps.
Since jQuery 3.4, pass { nonce: "..." } as the second argument so the executed script carries a CSP nonce — required on sites with a strict Content Security Policy for inline scripts.
jQuery.globalEval(code, options, doc) accepts a Document so code runs in that document's global context — useful for scripts inside iframes where the top-level window is the wrong scope.
No. It targets a browser document (and optional iframe Document). Use Node's own module system or vm APIs on the server — not jQuery.globalEval.