The eval function is a powerful and easy way to dynamically generate code, so what are the caveats?


Why is using the JavaScript eval function a bad idea?

I&#39;ve been looking at dynamic evaluation of Python code, and come across the `eval()` and `compile()` functions, and the `exec` statement.

Can someone please explain the difference between `eval` and `exec`, and how the different modes of `compile()` fit in?

What&#39;s the difference between eval, exec, and compile?

In the book that I am reading on Python, it keeps using the code `eval(input(&#39;blah&#39;))` 

I read the documentation, and I understand it, but I still do not see how it changes the `input()` function. 

What does it do? Can someone explain?

What does Python&#39;s eval() do? 

I&#39;m curious to know if R can use its `eval()` function to perform calculations provided by e.g. a string.

This is a common case:

    eval(&quot;5+5&quot;)

However, instead of 10 I get:

    [1] &quot;5+5&quot;

Any solution?



Evaluate expression given as a string

I&#39;m writing some JavaScript code to parse user-entered functions (for spreadsheet-like functionality). Having parsed the formula I _could_ convert it into JavaScript and run `eval()` on it to yield the result.

However, I&#39;ve always shied away from using `eval()` if I can avoid it because it&#39;s evil (and, rightly or wrongly, I&#39;ve always thought it is even more evil in JavaScript, because the code to be evaluated might be changed by the user).

So, when it is OK to use it?


When is JavaScript&#39;s eval() not evil?

I have a situation with some code where `eval()` came up as a possible solution.  Now I have never had to use `eval()` before but, I have come across plenty of information about the potential danger it can cause.  That said, I&#39;m very wary about using it.

My situation is that I have input being given by a user:

    datamap = input(&#39;Provide some data here: &#39;)

Where `datamap` needs to be a dictionary.  I searched around and found that `eval()` could work this out. I thought that I might be able to check the type of the input before trying to use the data and that would be a viable security precaution.

    datamap = eval(input(&#39;Provide some data here: &#39;)
    if not isinstance(datamap, dict):
        return

I read through the docs and I am still unclear if this would be safe or not.  Does eval evaluate the data as soon as its entered or after the `datamap` variable is called?

Is the `ast` module&#39;s `.literal_eval()` the only safe option?


Using python&#39;s eval() vs. ast.literal_eval()

Is it possible to create a template string as a usual string,

    let a = &quot;b:${b}&quot;;

and then convert it into a template string,

    let b = 10;
    console.log(a.template()); // b:10

without `eval`, `new Function` and other means of dynamic code generation?


Convert a string to a template string

After reading the [Bash man pages][1] and with respect to [this post][2], I am still having trouble understanding what exactly the `eval` command does and which would be its typical uses.

For example, if we do:

```lang-none
$ set -- one two three  # Sets $1 $2 $3
$ echo $1
one

$ n=1
$ echo ${$n}       ## First attempt to echo $1 using brackets fails
bash: ${$n}: bad substitution

$ echo $($n)       ## Second attempt to echo $1 using parentheses fails
bash: 1: command not found

$ eval echo \${$n} ## Third attempt to echo $1 using &#39;eval&#39; succeeds
one
```

What exactly is happening here and how do the dollar sign and the backslash tie into the problem?

  [1]: https://linux.die.net/man/1/bash
  [2]: http://www.unix.com/shell-programming-scripting/66063-eval-shell-scripting.html






The &#39;eval&#39; command in Bash and its typical uses

I am using the following class to easily store data of my songs.

    class Song:
        &quot;&quot;&quot;The class to store the details of each song&quot;&quot;&quot;
        attsToStore=(&#39;Name&#39;, &#39;Artist&#39;, &#39;Album&#39;, &#39;Genre&#39;, &#39;Location&#39;)
        def __init__(self):
            for att in self.attsToStore:
                exec &#39;self.%s=None&#39;%(att.lower()) in locals()
        def setDetail(self, key, val):
            if key in self.attsToStore:
                exec &#39;self.%s=val&#39;%(key.lower()) in locals()

I feel that this is just much more extensible than writing out an `if/else` block. However, `eval` seems to be considered a bad practice and unsafe to use. If so, can anyone explain to me why and show me a better way of defining the above class?


Why is using &#39;eval&#39; a bad practice?

I have a string like the following:

    String str = &quot;4*5&quot;;

Now I have to get the result of `20` by using the string.

I know in some other languages the `eval()` function will do this.
How can I do this in Java?

Is there an eval() function in Java?

I know this question sounds rather vague so I will make it more clear with an example:

    $var = &#39;bar&#39;;
    $bar = new {$var}Class(&#39;var for __construct()&#39;); //$bar = new barClass(&#39;var for __construct()&#39;);

This is what I want to do. How would you do it? I could off course use eval() like this:

    $var = &#39;bar&#39;;
    eval(&#39;$bar = new &#39;.$var.&#39;Class(\&#39;var for __construct()\&#39;);&#39;);

But I&#39;d rather stay away from eval(). Is there any way to do this without eval()?

instantiate a class from a variable in PHP?

I&#39;ve got a script that inserts some content into an element using `innerHTML`.

The content could for example be:

    &lt;script type=&quot;text/javascript&quot;&gt;alert(&#39;test&#39;);&lt;/script&gt;
    &lt;strong&gt;test&lt;/strong&gt;

Problem is that the code inside the `&lt;script&gt;` tag doesn&#39;t get executed.
I googled it a bit but there were no apparent solutions. If I inserted the content using jQuery `$(element).append(content);`the script parts got `eval`&#39;d before being injected into the DOM.

Has anyone got a snippet of code that executes all the `&lt;script&gt;` elements? The jQuery code was a bit complex so I couldn&#39;t really figure out how it was done.

**Edit**:

By peeking into the jQuery code I&#39;ve managed to figure out how jQuery does it, which resulted in the following code:

    Demo:
    &lt;div id=&quot;element&quot;&gt;&lt;/div&gt;
    
    &lt;script type=&quot;text/javascript&quot;&gt;
      function insertAndExecute(id, text)
      {
        domelement = document.getElementById(id);
        domelement.innerHTML = text;
        var scripts = [];
      
        ret = domelement.childNodes;
        for ( var i = 0; ret[i]; i++ ) {
          if ( scripts &amp;&amp; nodeName( ret[i], &quot;script&quot; ) &amp;&amp; (!ret[i].type || ret[i].type.toLowerCase() === &quot;text/javascript&quot;) ) {
      			scripts.push( ret[i].parentNode ? ret[i].parentNode.removeChild( ret[i] ) : ret[i] );
      		}
        }
      
        for(script in scripts)
        {
          evalScript(scripts[script]);
        }
      }
      function nodeName( elem, name ) {
      	return elem.nodeName &amp;&amp; elem.nodeName.toUpperCase() === name.toUpperCase();
      }
      function evalScript( elem ) {
      	data = ( elem.text || elem.textContent || elem.innerHTML || &quot;&quot; );
    
        var head = document.getElementsByTagName(&quot;head&quot;)[0] || document.documentElement,
      	script = document.createElement(&quot;script&quot;);
      	script.type = &quot;text/javascript&quot;;
      	script.appendChild( document.createTextNode( data ) );
      	head.insertBefore( script, head.firstChild );
      	head.removeChild( script );
    
      	if ( elem.parentNode ) {
      		elem.parentNode.removeChild( elem );
      	}
      }
    
      insertAndExecute(&quot;element&quot;, &quot;&lt;scri&quot;+&quot;pt type=&#39;text/javascript&#39;&gt;document.write(&#39;This text should appear as well.&#39;)&lt;/scr&quot;+&quot;ipt&gt;&lt;strong&gt;this text should also be inserted.&lt;/strong&gt;&quot;);
    &lt;/script&gt;

Executing &lt;script&gt; elements inserted with .innerHTML

I know that Lisp and Scheme programmers usually say that `eval` should be avoided unless strictly necessary. I’ve seen the same recommendation for several programming languages, but I’ve not yet seen a list of clear arguments against the use of `eval`. Where can I find an account of the potential problems of using `eval`?

For example, I know the problems of `GOTO` in procedural programming (makes programs unreadable and hard to maintain, makes security problems hard to find, etc), but I’ve never seen the arguments against `eval`.

Interestingly, the same arguments against `GOTO` should be valid against continuations, but I see that Schemers, for example, won’t say that continuations are &quot;evil&quot; -- you should just be careful when using them. They’re much more likely to frown upon code using `eval` than upon code using continuations (as far as I can see -- I could be wrong).

Why exactly is eval evil?

While `[] + []` is an empty string, `[] + {}` is `&quot;[object Object]&quot;`, and `{} + []` is `0`. Why is `{} + {}` NaN?

    &gt; {} + {}
      NaN

My question isn&#39;t why `({} + {}).toString()` is `&quot;[object Object][object Object]&quot;` while `NaN.toString()` is `&quot;NaN&quot;`, [this part has an answer here already][1].

My question is why does this happen only on the client side? On the server side ([Node.js][2]) `{} + {}` is `&quot;[object Object][object Object]&quot;`.

    &gt; {} + {}
    &#39;[object Object][object Object]&#39;

-----

**Summarizing**:

On the client side:
    
     [] + []              // Returns &quot;&quot;
     [] + {}              // Returns &quot;[object Object]&quot;
     {} + []              // Returns 0
     {} + {}              // Returns NaN

     NaN.toString()       // Returns &quot;NaN&quot;
     ({} + {}).toString() // Returns &quot;[object Object][object Object]&quot;
     var a = {} + {};     // &#39;a&#39; will be &quot;[object Object][object Object]&quot;
     
In Node.js:
     
     [] + []   // Returns &quot;&quot; (like on the client)
     [] + {}   // Returns &quot;[object Object]&quot; (like on the client)
     {} + []   // Returns &quot;[object Object]&quot; (not like on the client)
     {} + {}   // Returns &quot;[object Object][object Object]&quot; (not like on the client)

  [1]: https://stackoverflow.com/a/9033306/1348195
  [2]: http://en.wikipedia.org/wiki/Node.js


Why {} + {} is NaN only on the client side? Why not in Node.js?

I&#39;m working with this:

    GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)


I have a script like below:

    #!/bin/bash

    e=2
    
    function test1() {
      e=4
      echo &quot;hello&quot;
    }
    
    test1 
    echo &quot;$e&quot;

Which returns:

    hello
    4

But if I assign the result of the function to a variable, the global variable `e` is not modified:

    #!/bin/bash
    
    e=2
    
    function test1() {
      e=4
      echo &quot;hello&quot;
    }
    
    ret=$(test1)
    
    echo &quot;$ret&quot;
    echo &quot;$e&quot;

Returns:

    hello
    2

I&#39;ve heard of [the use of eval][1] in this case, so I did this in `test1`:

    eval &#39;e=4&#39;

But the same result.

Could you explain me why it is not modified? How could I save the echo of the `test1` function in `ret` and modify the global variable too?


  [1]: https://superuser.com/a/628865/235245

How to modify a global variable within a function in bash?

Time and time again, I see Bash answers on Stack Overflow using `eval` and the answers get bashed, pun intended, for the use of such an &quot;evil&quot; construct. Why is `eval` so evil?

If `eval` can&#39;t be used safely, what should I use instead?

Why should eval be avoided in Bash, and what should I use instead?

How do I print the environment variable just being set?

    NAME=sam echo &quot;$NAME&quot; # empty

You can see here using `eval` it works. Is this the way?

    NAME=sam eval &#39;echo $NAME&#39; # =&gt; sam

How to print / echo environment variables?

Are these two functions doing the same thing behind the scenes? (in single statement functions)

    var evaluate = function(string) {
        return eval(&#39;(&#39; + string + &#39;)&#39;);
    }

    var func = function(string) {
        return (new Function( &#39;return (&#39; + string + &#39;)&#39; )());
    }
    
    console.log(evaluate(&#39;2 + 1&#39;));
    console.log(func(&#39;2 + 1&#39;));



Are eval() and new Function() the same thing?

I start to read [JavaScript Patterns][1], some [codes][2] confused me.

    var global = (function () {
		return this || (1, eval)(&#39;this&#39;);
	}());

Here are my questions:

Q1: 

&gt; `(1, eval) === eval`?

Why and how does it work? 

Q2: Why not just

    var global = (function () {
		return this || eval(&#39;this&#39;);
	}());
or

     var global = (function () {
		return this;
	}());


  [1]: https://github.com/shichuan/javascript-patterns/
  [2]: https://github.com/shichuan/javascript-patterns/blob/master/general-patterns/access-to-global-object.html

(1, eval)(&#39;this&#39;) vs eval(&#39;this&#39;) in JavaScript?

In all the years I have been developing in PHP, I have always heard that using `eval()` is evil.

Considering the following code, wouldn&#39;t it make sense to use the second (and more elegant) option? If not, why?


    // $type is the result of an SQL statement, e.g.
    // SHOW COLUMNS FROM a_table LIKE &#39;a_column&#39;;
    // hence you can be pretty sure about the consistency
    // of your string.

    $type = &quot;enum(&#39;a&#39;,&#39;b&#39;,&#39;c&#39;)&quot;;

    // option one
    $type_1 = preg_replace(&#39;#^enum\s*$\s*\&#39;|\&#39;\s*$\s*$#&#39;, &#39;&#39;, $type);
    $result = preg_split(&#39;#\&#39;\s*,\s*\&#39;#&#39;, $type_1);

    // option two
    eval(&#39;$result = &#39;.preg_replace(&#39;#^enum#&#39;,&#39;array&#39;, $type).&#39;;&#39;);

When is eval evil in php?

I would like to perform arithmetic on one or more dataframes columns using `pd.eval`. Specifically, I would like to port the following code that evaluates a formula:

    x = 5
    df2[&#39;D&#39;] = df1[&#39;A&#39;] + (df1[&#39;B&#39;] * x)

...to code using `pd.eval`. The reason for using `pd.eval` is that I would like to automate many workflows, so creating them dynamically will be useful to me.

My two input DataFrames are:

    import pandas as pd
    import numpy as np

    np.random.seed(0)
    df1 = pd.DataFrame(np.random.choice(10, (5, 4)), columns=list(&#39;ABCD&#39;))
    df2 = pd.DataFrame(np.random.choice(10, (5, 4)), columns=list(&#39;ABCD&#39;))

    df1
       A  B  C  D
    0  5  0  3  3
    1  7  9  3  5
    2  2  4  7  6
    3  8  8  1  6
    4  7  7  8  1

    df2
       A  B  C  D
    0  5  9  8  9
    1  4  3  0  3
    2  5  0  2  3
    3  8  1  3  3
    4  3  7  0  1

I am trying to better understand `pd.eval`&#39;s `engine` and `parser` arguments to determine how best to solve my problem. I have gone through [the documentation][1], but the difference was not made clear to me.

1. What arguments should be used to ensure my code is working at the maximum performance?
2. Is there a way to assign the result of the expression back to `df2`?
3. Also, to make things more complicated, how do I pass `x` as an argument inside the string expression?

  [1]: https://pandas.pydata.org/pandas-docs/version/0.23.4/generated/pandas.eval.html






Dynamically evaluate an expression from a formula in Pandas

There are several questions on how to avoid using `eval(parse(...))`
 
  - [r-evalparse-is-often-suboptimal](https://stackoverflow.com/questions/11025031/r-evalparse-is-often-suboptimal)
  - [avoiding-the-infamous-evalparse-construct](https://stackoverflow.com/questions/13647046/avoiding-the-infamous-evalparse-construct)

Which sparks the questions:

  -  Why Specifically should `eval(parse())` be avoided?  
  -  And most importantly, What are the dangers? 
     - Are there any dangerous if the code is not used in production? (I&#39;m thinking, any danger of getting back unintended results. Clearly if you are not careful about what you are parsing, you will have issues. But is that any more dangerous than being sloppy with `get()`?) 

What specifically are the dangers of eval(parse(...))?

I have an instance of the `Account` class. Each account object has an owner, reference, etc.

One way I can access an accounts properties is through accessors like 

    account.Reference;

but I would like to be able to access it using dynamic string selectors like:

    account[&quot;PropertyName&quot;];

just like in JavaScript. So I would have `account[&quot;Reference&quot;]` which would return the value, but I also would like to be able to assign a new value after that like:

    account[&quot;Reference&quot;] = &quot;124ds4EE2s&quot;;

I&#39;ve noticed I can use 

    DataBinder.Eval(account,&quot;Reference&quot;) 

to get a property based on a string, but using this I can&#39;t assign a value to the property.

Any idea on how I could do that?

Accessing object property as string and setting its value

I would like to do the equivalent of:

    object result = Eval(&quot;1 + 3&quot;);
    string now    = Eval(&quot;System.DateTime.Now().ToString()&quot;) as string

Following Biri s [link][1], I got this snippet (modified to remove obsolete method `ICodeCompiler.CreateCompiler()`:

    private object Eval(string sExpression)
    {
        CSharpCodeProvider c = new CSharpCodeProvider();
        CompilerParameters cp = new CompilerParameters();
        
        cp.ReferencedAssemblies.Add(&quot;system.dll&quot;);

        cp.CompilerOptions = &quot;/t:library&quot;;
        cp.GenerateInMemory = true;

        StringBuilder sb = new StringBuilder(&quot;&quot;);
        sb.Append(&quot;using System;\n&quot;);

        sb.Append(&quot;namespace CSCodeEvaler{ \n&quot;);
        sb.Append(&quot;public class CSCodeEvaler{ \n&quot;);
        sb.Append(&quot;public object EvalCode(){\n&quot;);
        sb.Append(&quot;return &quot; + sExpression + &quot;; \n&quot;);
        sb.Append(&quot;} \n&quot;);
        sb.Append(&quot;} \n&quot;);
        sb.Append(&quot;}\n&quot;);

        CompilerResults cr = c.CompileAssemblyFromSource(cp, sb.ToString());
        if (cr.Errors.Count &gt; 0)
        {
            throw new InvalidExpressionException(
                string.Format(&quot;Error ({0}) evaluating: {1}&quot;, 
                cr.Errors[0].ErrorText, sExpression));
        }

        System.Reflection.Assembly a = cr.CompiledAssembly;
        object o = a.CreateInstance(&quot;CSCodeEvaler.CSCodeEvaler&quot;);

        Type t = o.GetType();
        MethodInfo mi = t.GetMethod(&quot;EvalCode&quot;);

        object s = mi.Invoke(o, null);
        return s;

    }  


  [1]: http://www.codeproject.com/KB/cs/evalcscode.aspx

How can I evaluate a C# expression dynamically?

Is there a way to calculate a formula stored in a string in JavaScript without using `eval`?

Normally I would do something like

    var apa = &quot;12/5*9+9.4*2&quot;;
    alert(eval(apa));

So, does anyone know about alternatives to `eval`?

Calculate string value in javascript, not using eval

Can anyone show me some absolutely minimal ASP.NET code to understand `Eval()` and `Bind()`?

It is best if you provide me with two separate code-snippets or may be web-links.



Understanding ASP.NET Eval() and Bind()

I understand about how `eval()` works in non-strict contexts, however the case of using `eval()` in strict mode has completely befuddled me.  When `eval()` is called directly in the global scope, variables are kept inside the new `eval()` scope:

    &#39;use strict&#39;;
    eval(&#39;var a = 1;&#39;);
    console.log(a); // ReferenceError: a is not defined

However, if I perform an _indirect_ call to `eval()` in the global scope (should be the same thing, right?), it acts as though it is not in strict mode (if you don&#39;t believe me, see [this JSFiddle][7]):

    &#39;use strict&#39;;
    (0, eval)(&#39;var a = 1;&#39;); // indirect call to eval
    console.log(a); // 1???

&lt;sub&gt;For an explanation of what `(0, eval)` does: see [Why does google main page use (0, obj.func)(args) syntax?](https://stackoverflow.com/questions/19535601/why-does-google-main-page-use-0-obj-funcargs-syntax).&lt;/sub&gt;

At least according to my understanding of how `eval()` is supposed to work in strict mode, it is meant to (no matter whether `eval()` is called directly or indirectly) create a new scope for variables defined in the `eval()` call, however this doesn&#39;t seem to be the case here. (ECMA-262 spec 5th ed [10.4.2][1])

This is the case in all major browsers (including Internet Explorer 10, Chrome 30 and Firefox 24) so I don&#39;t think it&#39;s a bug.  Aren&#39;t they both meant to do the same thing, and if not, why is this the case?

&lt;sub&gt;Note: yes, I know the &quot;dangers&quot; of using `eval()` - I simply want to understand the logic behind this :)&lt;/sub&gt;
      
[1]: http://ecma-international.org/ecma-262/5.1/#sec-10.4.2 &quot;link to this section&quot;
[2]: http://ecma-international.org/ecma-262/5.1/#sec-15.1.2.1.1
[3]: http://ecma-international.org/ecma-262/5.1/#sec-10.4.1.1
[4]: http://ecma-international.org/ecma-262/5.1/#sec-10.3
[5]: http://ecma-international.org/ecma-262/5.1/#sec-10.5
[6]: http://ecma-international.org/ecma-262/5.1/#sec-10.2.2.2
[7]: http://jsfiddle.net/hSLJq/3/

Indirect eval call in strict mode

I want an easy way to do a &quot;calculator API&quot; in Python.

Right now I don&#39;t care much about the exact set of features the calculator is going to support.

I want it to receive a string, say `&quot;1+1&quot;` and return a string with the result, in our case `&quot;2&quot;`.

Is there a way to make `eval` safe for such a thing? 

For a start I would do 

    env = {}
    env[&quot;locals&quot;]   = None
    env[&quot;globals&quot;]  = None
    env[&quot;__name__&quot;] = None
    env[&quot;__file__&quot;] = None
    env[&quot;__builtins__&quot;] = None
    
    eval(users_str, env)

so that the caller cannot mess with my local variables (or see them).

But I am sure I am overseeing a lot here. 

Are `eval`&#39;s security issues fixable or are there just too many tiny details to get it working right?




Python: make eval safe

I know this may be a newbie question, but I&#39;m curious as to the main  benefit of  `eval()`  - where would it be used best? I appreciate any info.

What&#39;s the main benefit of using eval() in JavaScript?

I would like to have the ability to let users submit arbitrary JavaScript code, which is then sent to a Node.JS server and safely executed before the output is sent back to multiple clients (as JSON). The `eval` function comes to mind, but I know this has multiple security concerns (the user submitted code would be able to access Node&#39;s File API, etc). I have seen some projects like Microsoft Web Sandbox and Google Caja which allow execution of sanitized markup and script (for embedding third-party ads on websites), but it seems that these are client-side tools and I&#39;m not sure if they can be safely used within Node.

Is there a standard way to sandbox and execute non-trusted JavaScript in Node, getting the output. Is it a mistake to try and do this server-side?

**EDIT:** It&#39;s not important that the user be able to leverage the full capabilities of JavaScript, in fact it would be preferable to be able to pick and choose which APIs would be provided to the user code.

**EDIT:** I am going to go ahead and update with what I found. This Sandcastle module ([**`bcoe/sandcastle`**](https://github.com/bcoe/sandcastle)) seems to aim to do what I have in mind. Not sure how secure it is, but since I this is not for anything too important I think I&#39;ll if try it. I&#39;ll add my own answer if I&#39;m able to successfully do this.

All Eval Solutions on Gang of Coders

Total of 30 Eval Solutions

Why is using the JavaScript eval function a bad idea?

What's the difference between eval, exec, and compile?

What does Python's eval() do?