javascript (![]+[])[+[]]... 解释为什么会这样
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4170978/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
(![]+[])[+[]]... Explain why this works
提问by cdxf
alert((![]+[])[+[]]+(![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]);
The output of this code is: fail. Why?
这段代码的输出是：fail。为什么？
By the way, (![]+[])[+!+[]] == 'false'[1], right?. But why ![]+[] == "false"and why +!+[] == 1?
顺便说一句(![]+[])[+!+[]] == 'false'[1]，对吧？但为什么![]+[] == "false"和为什么+!+[] == 1？
回答by CMS
As @Mauricio commented (![]+[])[+[]]is "f" (the first char of "false"), (![]+[])[+!+[]])is "a", etc...
正如@Mauricio 评论的那样(![]+[])[+[]]是“f”（“false”的第一个字符），(![]+[])[+!+[]])是“a”，等等......
How does it work?
它是如何工作的？
Let's examine the first character, 'f':
让我们检查第一个字符 'f'：
(![]+[])[+[]]; // 'f'
The first part of the expression—between parentheses—is composed by ![]+[], the first operand of the Addition operator is ![]and it will produce false, because an array object—as any other Object instance—is truthy, and applying the Logical (!) NOT unary operator, it produces the value false, for example.
表达式的第一部分——在括号之间——由 组成![]+[]，加法运算符的第一个操作数是![]，它将产生false，因为数组对象——与任何其他对象实例一样——是真的，并且应用逻辑 (!) 非一元运算符，false例如，它产生值。
![]; // false, it was truthy
!{}; // false, it was truthy
!0; // true, it was falsey
!NaN; // true, it was falsey
After it, we have the second operand of the addition, an empty Array, [], this is made just to convert the falsevalue to String, because the string representation of an empty array is just an empty string, is equivalent to:
在它之后，我们有加法的第二个操作数，一个空数组，，[]这只是为了将false值转换为字符串，因为空数组的字符串表示只是一个空字符串，相当于：
false+[]; // "false"
false+''; // "false"
The last part, the pair of square brackets after the parentheses, they are the property accessor, and they receive an expression, which is formed by the Unary Plus Operator applied to an empty array again.
最后一部分，括号后的那对方括号，它们是属性访问器，它们接收一个表达式，该表达式由再次应用于空数组的一元加运算符形成。
What the Unary Plus Operator does is type conversion, to Number, for example:
一元加运算符所做的是类型转换，Number例如：
typeof +"20"; // "number"
One more time, this is applied to an empty Array, and as I said before, the String representation of an Array is an empty string, and when you convert an empty string to Number, it is converted to zero:
再一次，这适用于一个空数组，正如我之前所说的，一个数组的字符串表示是一个空字符串，当你将一个空字符串转换为数字时，它被转换为零：
+[]; // 0, because
+[].toString(); // 0, because
+""; // 0
Therefore we can "decode" the expression to in some steps:
因此，我们可以通过一些步骤将表达式“解码”为：
(![]+[])[+[]];
(false+[])[+[]];
(false+'')[+[]];
(false+'')[0];
('false')[0]; // "f"
Note that accessing characters by using the bracket notation on String values was not part of the ECMAScript 3rd. Edition Specification, (that's why the charAtmethod existed).
请注意，通过在字符串值上使用括号表示法来访问字符不是 ECMAScript 3rd 的一部分。版本规范，（这就是该charAt方法存在的原因）。
However this kind of "index properties" that represent the characters of a string were standardized on ECMAScript 5, and even before the standardization the feature was available in a good number of browsers (even in IE8 (standards mode)).
然而，这种表示字符串字符的“索引属性”已在 ECMAScript 5 上标准化，甚至在标准化之前，该功能在很多浏览器中都可用（甚至在 IE8（标准模式）中）。
