Don't be lazy. Don't use eval().

http://blog.thetonk.com/archives/dont-be-lazy-dont-use-eval

by azanar • 17 years ago

3 6 17 years ago

blog.thetonk.com

spectre• 17 years ago

Reminds me of an Instructor I had who insisted against using printf calls with the format string created outside the call.

there• 17 years ago

because he was right?

http://en.wikipedia.org/wiki/Format_string_bug

yummyfajitas• 17 years ago

I think better advice would be "Don't use eval on user-supplied strings".

It is quite safe to use eval on strings you generate yourself. It's like using macros, but with added syntax errors.

jongraehl• 17 years ago

That also works for marketing static typing - now with added syntax errors!

michael_dorfman• 17 years ago

The most noteworthy thing about this (misguided) post is that the blogger's professor responded, thoroughly (http://blog.thetonk.com/archives/dont-be-lazy-dont-use-eval#...) and the blogger gracefully backed down("I was proven wrong. It happens.")

cmtonkinson• 17 years ago

I have to point out that (IMHO) you've taken that quote a _bit_ out of context. If you'll read the rest of my remarks, you'll see the qualification text: I was wrong about eval() in Python however my arguments remain standing in languages which don't support sandboxing - and, as a few readers pointed out, even Python's sandboxing isn't a sure bet. I used Python in my examples because that's where the original disagreement arose.

Don't be lazy. Don't use eval().

Related Stories