Well, that's a pretty broad statement. Do you mean that it's evil when called with untrusted input by a trusting program or evil in general and not to be used

Well, that's a pretty broad statement. Do you mean that it's evil when called with untrusted input by a trusting program or evil in general and not to be used under any or most circumstances? The article suggests the former but your comment the latter. I would think the function is pretty safe and okay when you use it with a known input. Better than writing your own, anyway.