I have decided to give a supplementary answer on the eval()
which is a valid solution. This can be seen in Eval is either good or bad?.
To tell the truth any information about the eval()
that I don’t have that caveat for me would be wrong.
Use the eval()
is extremely dangerous. You can even use it without taking big risks, but almost no one knows how to do it, so it’s best not to try before making sure you understand all the risks and know how to solve them. It’s so complicated to get it right that it’s often better to use more complex shape than it.
The question does not make clear where this information comes from. If it comes from a customer, then forget the eval()
, the work to ensure security in it is so great that making the simple formula compiler for what it needs is simpler. Maybe we can even do it with RegEx
, that I do not like, but it is a solution. The solution goes through a parser.
If the information doesn’t come externally, then it’s likely to be safe, though, why would you use a eval()
in something that does not come externally? There may be a reason, but it is unlikely to be the right mechanism. I’ve seen a lot of people using this kind of resource, for lazy of typing codes. That’s a very wrong reason.
This does not provide an answer to the question. To criticize or request clarification from an author, leave a comment below its publication. - From Review
– Guilherme Nascimento
I think it provides an answer and more important that the answer accepts, after all says that the
eval()
can be done, but should not be used and gives the real solution, just does not give a parser complete because it was not asked and would be very broad. I know the AP will go the easy and unsafe way, but it serves for people who care about security to understand that this is not a suitable solution.– Maniero
I do not disagree with what I said, it is important, I only disagree with this being an answer, because it speaks how it can be done but it does not present an example to determine how a complete response, I think it would fit more as a recommendation comment.
– Guilherme Nascimento
But it’s still an answer, you just disagree with what was put. Actually today in moderation I see the signs and realize that many people do not know what is an answer or not, I have to refuse a lot. Note the text that is placed when you choose this option and tell me if it makes any sense here. The example could only be given by giving a code that would not even fit in a response. At least in the form that I would do. But there is a new information given, it is up to the author to ask more specific questions if he is interested, which we have seen that there is not, he has already chosen the risky solution
– Maniero