I have decided to give a complementary answer on the eval()
which is a valid solution. This can be seen at Is Eval a Good Guy or a Bandit? .
To tell you the truth, any information about eval()
that does not have this caveat for me borders on being wrong.
Using eval()
is very dangerous. You can even use it without taking big risks, but almost nobody knows how to do it, so it's best not to try before you're sure you understand all the risks and know how to solve them. It's so complicated to make sure that it's often better to use a more complex form than it.
The question does not clarify where this information comes from. If it comes from a client, then forget the eval()
, the job to ensure security in it is so great that making the simple formula compiler for what it needs is simpler. Maybe I can even do it with RegEx
, which I do not like, but it's a solution. The solution goes through a parser .
If the information does not come externally, then it is likely to be safe, though, why would you use eval()
on something that does not come externally? There may be a motive, but it is unlikely to be the right mechanism. I've seen a lot of people using such a feature, for lazy to enter codes . This is a very wrong motive.