From: Marko Schulz <in6x059@...>
Date: 2002-04-03T09:31:42+09:00
Subject: Re: Is eval a code/design smell?

On Wed, Apr 03, 2002 at 09:11:18AM +0900, Chris Morris wrote:
> I seem to have an inherent distaste for eval, but I don't know why. I've
> heard it has performance concerns, but that seems to be the only pragmatic
> reason to not use it in cases where that matters. Are there any other
> pragmatic concerns with eval? Is its use a design red-flag? Is there
> something to my gut instinct, or is it a holdover from my strong-typing
> past?

There is also the security problem: If the string you eval is somehow
connected to user input, you may have to check it very carefully. At
least if the script is run as a different user, is a CGI-Script or
something similar.

-- 
marko schulz