4 ms·
Don't be lazy. Don't use eval().
- spectre 17y agoReminds me of an Instructor I had who insisted against using printf calls with the format string created outside the call.
- there 17y agobecause he was right? http://en.wikipedia.org/wiki/Format_string_bug http://en.wikipedia.org/wiki/Format_string_bug
- yummyfajitas 17y agoI think better advice would be "Don't use eval on user-supplied strings". It is quite safe to use eval on strings you generate yourself. It's like using macros, but with added syntax errors.
- jongraehl 17y agoThat also works for marketing static typing - now with added syntax errors!
- kwehgfjhgd 17y agoPut in his place by his lecturer on his own blog, nice.
- michael_dorfman 17y agoThe most noteworthy thing about this (misguided) post is that the blogger's professor responded, thoroughly (http://blog.thetonk.com/archives/dont-be-lazy-dont-use-eval#comment-168 http://blog.thetonk.com/archives/dont-be-lazy-dont-use-eval#...) and the blogger gracefully backed down("I was proven wrong. It happens.")
- cmtonkinson 17y agoI have to point out that (IMHO) you've taken that quote a _bit_ out of context. If you'll read the rest of my remarks, you'll see the qualification text: I was wrong about eval() in Python however my arguments remain standing in languages which don't support sandboxing - and, as a few readers pointed out, even Python's sandboxing isn't a sure bet. I used Python in my examples because that's where the original disagreement arose.