The eval() function evaluates an expression, but “5+5″ is a string, not an expression. Use parse() with text=<string> to change the string into an expression: > eval(parse(text=”5+5”)) [1] 10 > class(“5+5”) [1] “character” > class(parse(text=”5+5″)) [1] “expression” Calling eval() invokes many behaviours, some are not immediately obvious: > class(eval(parse(text=”5+5″))) [1] “numeric” > class(eval(parse(text=”gray”))) [1] “function” … Read more
The short answer, or TL;DR Basically, eval is used to evaluate a single dynamically generated Python expression, and exec is used to execute dynamically generated Python code only for its side effects. eval and exec have these two differences: eval accepts only a single expression, exec can take a code block that has Python statements: … Read more
Simplified ES6 version of @joshcomley’s answer with an example. No JQuery, No library, No eval, No DOM change, Just pure Javascript. http://plnkr.co/edit/MMegiu?p=preview var setInnerHTML = function(elm, html) { elm.innerHTML = html; Array.from(elm.querySelectorAll(“script”)).forEach( oldScript => { const newScript = document.createElement(“script”); Array.from(oldScript.attributes) .forEach( attr => newScript.setAttribute(attr.name, attr.value) ); newScript.appendChild(document.createTextNode(oldScript.innerHTML)); oldScript.parentNode.replaceChild(newScript, oldScript); }); } Usage $0.innerHTML = HTML; … Read more
[*] There’s more to this problem than meets the eye. We’ll start with the obvious: eval has the potential to execute “dirty” data. Dirty data is any data that has not been rewritten as safe-for-use-in-situation-XYZ; in our case, it’s any string that has not been formatted so as to be safe for evaluation. Sanitizing data … Read more
I would be cautious in calling eval() pure evil. Dynamic evaluation is a powerful tool and can sometimes be a life saver. With eval() one can work around shortcomings of PHP (see below). The main problems with eval() are: Potential unsafe input. Passing an untrusted parameter is a way to fail. It is often not … Read more
You can use the ScriptEngine class and evaluate it as a Javascript string. ScriptEngineManager manager = new ScriptEngineManager(); ScriptEngine engine = manager.getEngineByName(“js”); Object result = engine.eval(“4*5”); There may be a better way, but this one works.
datamap = eval(input(‘Provide some data here: ‘)) means that you actually evaluate the code before you deem it to be unsafe or not. It evaluates the code as soon as the function is called. See also the dangers of eval. ast.literal_eval raises an exception if the input isn’t a valid Python datatype, so the code … Read more
I’d like to take a moment to address the premise of your question – that eval() is “evil“. The word “evil“, as used by programming language people, usually means “dangerous”, or more precisely “able to cause lots of harm with a simple-looking command”. So, when is it OK to use something dangerous? When you know … Read more
Improper use of eval opens up your code for injection attacks Debugging can be more challenging (no line numbers, etc.) eval’d code executes slower (no opportunity to compile/cache eval’d code) Edit: As @Jeff Walden points out in comments, #3 is less true today than it was in 2008. However, while some caching of compiled scripts … Read more
Yes, using eval is a bad practice. Just to name a few reasons: There is almost always a better way to do it Very dangerous and insecure Makes debugging difficult Slow In your case you can use setattr instead: class Song: “””The class to store the details of each song””” attsToStore=(‘Name’, ‘Artist’, ‘Album’, ‘Genre’, ‘Location’) … Read more