Yeah sure, I agree that eval is always potentially dangerous... I figured this is rather well-known. And, I wasn't trying to spread "great memes" :) Rather, I was simply trying to generically answer the problem of "Normally, I would use a double quoted string in my script... now what do I do to arrive at the same effect when I hold the part in between the quotes literally in a string, like when having read it from a file?" Nowhere in the OP was any mention of other people potentially having control over the input.
Along similar lines you'd have to warn people every time they interpolate some variable into some command like
because, if $imgname could potentially come from an insecure source, they might get into trouble inadvertendly running something likesystem "convert $imgname.png $imgname.jpg"
system "convert ; rm -rf ~/* ;.png ..."
I'd probably even mention it if the danger is obvious, like someone inexperienced trying to execute code like this in CGI context or some such, but otherwise... should we always warn?
In reply to Re^3: ascii colors from text file
by almut
in thread ascii colors from text file
by Anonymous Monk
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |