Re^2: I failed today

[atcroft]

I'm no fan of Python myself, but as most of us have seen Perl (mis-)features or improper usage used as examples of why not to use Perl, I feel someone should be intellectually honest enough to call the same when applied elsewere. In the example given, this is the use of a poorly-named feature that somehow survived in versions of Python prior to the 3.x series.

In the 2.7.18 documentation, it says that input([prompt]) is the equivalent of eval(raw_input([prompt])), and to consider using the raw_input() function for general input from users. Their eval() is similar to our string eval() function, so I ask the question -- If you were writing a Perl script and accepting credentials, can you think of a valid reason to pass the user's input immediately through a string eval? (If you're writing a program that needs to be security-conscious, I expect some thought on the functions one calls, and honest research when testing shows something misbehaving (it was tested, right?).)

[bliako]

so I ask the question -- If you were writing a Perl script and accepting credentials, can you think of a valid reason to pass the user's input immediately through a string eval?

Of course not.

Whereas Perl reminds us all the time that accepting unchecked user input is bad practice. And, god forbid, eval()'ing unchecked user input is criminal, Python decides to name the input+eval function input() and the sane just-input function as ... raw_input(). Why penalise the sane and common practice with more keystrokes? But you are right that reading the documentaton is key to avoid input() misbeheaving and fall in this trap.