What is the correct way to "serialize" functions in javascript for later use

Just use eval to recreate the function after loading it as a string. So if you deserialize an object myObj from JSON, and you have a property:

myObj = {    ....    function: "function() { ... }"}

you can very easily turn it to a real function:

eval("myObj.func = " + myObj.func);

http://jsfiddle.net/kceTr/

Oh - I am not sure if that was an edit or I missed it before - but re: eval.

Eval is a tool. You want to store a function in a database. It really doesn't make much difference if you have to "eval" to turn it into code, or there was some other magic way to do it: if someone can change the data in your DB, then they can change a function.

If you need to store a function, then eval is your tool. It's not "bad" by nature, it's bad because it's easy to misuse. Whether you use it well or not is up to you.

Remember anything running on the client is still just running on the client. There's nothing a malicious person could do with eval, that they couldn't do with the Chrome debugger a lot more easily. Anyone can always run any code they want on the client, it's up to your server to decide how to handle what it receives. There's nothing safe on the client in the first place...

Changing the prototype of the object is a half thought I have.

You've got your library like

library = {  "myObj" : {"name" : "myObj", "type" : "myType", "function" : function () { } } //, etc}

You've got an object (let's call it theObj) that you know is a myObj (due to a string maybe? property?)

theObj.__proto__ = library["myObj"];

That way you can execute

theObj.function(...);

jsfiddle example (it's rough!). Also, be careful with proto, it's deprecated (1) (2)

As to serializing the functions, can you get them in using a script tag that points to something serverside that slurps them from the db and returns the js? Just include them inline as you render the page (in a script block)? Or, if all else fails, eval should work, as long as you know that the functions you've got stored in the database are clean and safe.

A better approach might be to serialize the object's properties when you "sleep" it, and "waking" the object by reattaching its properties to a new instance of the object with the appropriate methods defined.