Evaluating or running JavaScript built from variables inside a WebView enables script injection.
JSON-encode values passed into WebView JavaScript and avoid injecting raw user input.