datamap = eval(input(‘Provide some data here: ‘)) means that you actually evaluate the code before you deem it to be unsafe or not. It evaluates the code as soon as the function is called. See also the dangers of eval. ast.literal_eval raises an exception if the input isn’t a valid Python datatype, so the code … Read more
I’d like to take a moment to address the premise of your question – that eval() is “evil“. The word “evil“, as used by programming language people, usually means “dangerous”, or more precisely “able to cause lots of harm with a simple-looking command”. So, when is it OK to use something dangerous? When you know … Read more
The eval function lets a Python program run Python code within itself. eval example (interactive shell): >>> x = 1 >>> eval(‘x + 1’) 2 >>> eval(‘x’) 1
The eval() function evaluates an expression, but “5+5″ is a string, not an expression. Use parse() with text=<string> to change the string into an expression: > eval(parse(text=”5+5”)) [1] 10 > class(“5+5”) [1] “character” > class(parse(text=”5+5″)) [1] “expression” Calling eval() invokes many behaviours, some are not immediately obvious: > class(eval(parse(text=”5+5″))) [1] “numeric” > class(eval(parse(text=”gray”))) [1] “function” … Read more
The short answer, or TL;DR Basically, eval is used to evaluate a single dynamically generated Python expression, and exec is used to execute dynamically generated Python code only for its side effects. eval and exec have these two differences: eval accepts only a single expression, exec can take a code block that has Python statements: … Read more
Improper use of eval opens up your code for injection attacks Debugging can be more challenging (no line numbers, etc.) eval’d code executes slower (no opportunity to compile/cache eval’d code) Edit: As @Jeff Walden points out in comments, #3 is less true today than it was in 2008. However, while some caching of compiled scripts … Read more