From: Robert Klemme <shortcutter@...>
Date: 2007-06-08T19:30:11+09:00
Subject: Re: How to use strings as code

On 08.06.2007 02:36, Giles Bowkett wrote:
> On 6/7/07, Kyle Rabe <kyle.rabe@massstreetmusic.com> wrote:
>> In short, I'm looking for a way to grab a string from a database and 
>> use it as code in my rails app.  I understand the security 
>> implications, but it's still what I want to do (and I don't know what 
>> other options I have!).
> 
> it's pretty easy, but I wouldn't recommend doing it.
> 
> string = "p 'hello world'"
> eval(string)

To make it safer, he could do some checks to verify the filter is legal, 
something like

def convert(filter)
   case filter
     when /\A\d+\.{2,3}\d+\z/, /\A[+-]?\d+\z/
       eval filter
     ...
     else
       raise "Filter Error: #{filter}"
   end
end

Kind regards

	robert