> That's neat. When just the function call is the string,
> eval() seems appropriate. (For example, if reading what
> function to call from a file.)
Its conventient but incredibly dangerous.
Its much better in that case to create a dictionary of allowed
(ie safe!) functions that can vbe read and then look that up
from the file input.
Otherwise anyone who can access the file (legitimately or
otherwise) can start calling any of the standard Python functions,
including os.unlink() to delete files, or even os.system(), to do
just about anything - howsabout formatting your disk?
ok_funks = {
'some_func' : some_func,
'another_func': another_func,
'some_fancy_name': sys.exit
}
func = raw_input('type a function name>')
try: ok_funks[func']()
except: print 'Thats not a valid function'
eval and exec are seductively powerful but they are immensely
dangerous in a world of crackers and virus makers. They should
only ever be used in strictly controlled scebnarios and even then
as a last resort.
HTH,
Alan G.
___________________________________________________________
What kind of emailer are you? Find out today - get a free analysis of your
email personality. Take the quiz at the Yahoo! Mail Championship.
http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk _______________________________________________
Tutor maillist - Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor
