in reply to Using user input to return variable typed.
Generally speaking, eval is not "good design". Why not? Because the user could type this:use warnings; use strict; my ($thing,$foo,$blah) = (1,2,3); my $done=0; while (!$done) { print "What would you like to know? "; $_=<>; chomp; if (/^exit$/) { $done=1; } else { my $result = eval "\$$_"; if ($@) { print "bad variable name\n"; } else { print "\$$_=$result\n";; } } }
What would you like to know? foo;system("any malicious command here")
You could make this somewhat safer by sanitizing your input, but it is still better to avoid eval in production code. Besides the security issue, it also makes for confusing, hard to maintain code.
Nevertheless, I wanted to point this out because it can be very useful, especially for the quick-and-dirty tasks that Perl handles so well.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: Using user input to return variable typed.
by myelinviolin (Novice) on Nov 13, 2012 at 14:45 UTC | |
by davido (Cardinal) on Nov 13, 2012 at 16:13 UTC | |
by thmsdrew (Scribe) on Nov 13, 2012 at 16:01 UTC | |
by myelinviolin (Novice) on Nov 13, 2012 at 16:21 UTC |