Q:

Javascript: How to use eval() safely

I am building a little game and I've gotten to the point where I need to calculate data in the tips of abilities which is unique to each individual unit.  So to do this I figured I'm gonna basically need a formula.  I don't know if this is the way it's supposed to be done but here's what I've come up with
tip = 'Hurls a fire ball at your enemy, dealing [X] damage.'; 
formula = '5 * unit.magicPower * abilitylevel';

So  for each unit's tool tip I use
tip.replace('[X]', eval(formula))

Which appears to work fine, but what I'm concerned about is the safety of this code.  It hasn't been once or twice that I've seen people discouraging the use of it.  Are there any potential issues that may occur with the way I'm using eval()? 

A:

As long as you control the input into eval, it's safe to use it.  The concern comes in when you're using it to process input that you don't control.  At that point, it becomes unsafe because it's a full JavaScript parser but people sometimes try to use it as just an expression evaluator (for instance, when parsing JSON from a source they don't control). 
The other objection is that it's firing up a full JavaScript parser (and so in theory costly), but frankly unless you're doing this hundreds of thousands of times in a tight loop, it's not going to matter.