Hacker News Reader

Parent Full thread

sannee

Or use whatever tools are included in their language for safely evaluating strings (like ast.literal_eval in Python).

View on HN

It's PHP there is none. In fact most languages don't include a safe way to evaluate strings out of the box.

> It's PHP there is none.

This seems to disprove that, no?

https://secure.php.net/manual/en/runkit.sandbox.php

Allow me to rephrase, no cheap way to evaluate arbitrary strings without spinning up another vm.

That’s not true either.

explain?

That's an extension. It doesn't come with PHP (not "out of the box").

Rails doesn’t come with a default install of Ruby. Xcode doesn’t come pre-installed on macOS. You have to install Chrome on every major desktop OS as it doesn’t come by default.

Installing and configuring your environment to your needs should be entry level stuff for a developer, so what was the point of your reply?

Reply on news.ycombinator.com