使用 eval() 是否有充分的理由？
在我看来，eval() 受到了与 goto 相同的蔑视。我所说的 eval 是指将字符串作为代码执行的函数，如 PHP、Python、JavaScript 等中所示。是否存在使用 eval() 的情况是否合理（perl 除外）？如果没有，为什么有这么多语言实现它？
It seems to me that eval() is treated with the same disdain that goto is. And by eval, I mean a function for executing a string as code, as seen in PHP, Python, JavaScript, etc. Is there ever a situation where using eval() is justified (except perl)? And if not, why do so many languages implement it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
是的 - 当没有其他方法可以在合理的代码行数内以合理的清晰度完成给定的任务时。
这消除了 99% 在所有语言和上下文中全面使用
eval的情况。Yes - when there is no other way to accomplish the given task with a reasonable level of clarity and within a reasonable number of lines of code.
This eliminates 99% of cases where
evalis used, across the board in all languages and contexts.在动态生成代码的情况下，eval 通常是最方便的解决方案。即使在不正式支持 eval 的语言中，例如 Java，它们也支持运行时类的反射和修改，这是类似的。 （请参阅 Stu Halloway 的 Component Development for the Java Platform 等书籍）
eval is often the most expedient solution in situations where you are dynamically generating code. Even in languages that do not officially support eval, such as Java, they support reflection and modification of classes at runtime which are similar. (See books such as Stu Halloway's Component Development for the Java Platform )
一个合理的用途是，如果您有一种建立在另一种语言之上的解释语言，但您仍然希望提供某种“逃生舱口”以允许人们返回到底层语言提供的功能。一个例子是在 Lisp 中实现 Prolog，然后定义一个谓词，允许通过 EVAL 直接使用 Lisp 函数。
One reasonable use is if you have an interpreted language that you've built on top of another language, but you still want to provide some sort of "escape hatch" to allow people to get back to functions that are provided by the underlying language. One example is implementing Prolog in Lisp and then defining a predicate that allows direct use of Lisp functions via
EVAL.对于快速破解来说，没问题，因为这是一个方便的快速方法。
在生产代码中，请将其视为最后的手段 - 即使这样，也要尝试其他方法 - 因为
eval难以控制，因此很危险。对于任何重要的事情，实现一种子语言。For quick hacks, no problem because it's a handy quick-out.
In production code, consider it a last resort—and even then, try something else—because
evalis difficult to control and thus dangerous. For anything non-trivial, implement a sublanguage.我在对网站进行渗透测试时使用过一次 - 我们编写了一个小型 php 脚本，可以动态解密并执行来自非记录 HTTP 数据源的加密签名有效负载。这是迄今为止我见过的 eval() 的最佳用法。
（换句话说：不，我从未见过 eval 的良好用途）
I used it once while pentesting a site - we wrote a small php script that decrypts and executes cryptographically signed payloads from non-logged HTTP data sources on the fly. This is the best use I've seen of eval() so far.
(In other words: no, I've never seen a good use for eval)
随心所欲的想法： eval 对于实现穷人的表达式编译器或类似的东西很有用。它也是卫生宏指令的暗淡、生锈的替代品。
Offhand thought: eval is good for implementing a poor man's expression compiler, or things like that. It's also a dull, rusty substitute for hygienic macros.
也许我太多地使用
sh和perl，但我从未见过有人对待 eval 带着goto的蔑视。所以我的答案是：“当你编写
perl 5和sh时，eval是合适的”。eval块是 Perl 中主要的try/catch机制，没有它就很难编写安全的代码。Maybe I use
shandperltoo much, but I've never seen anyone treat eval with the disdain thatgotogets.So my answer is: '
evalis suitable when you are writingperl 5andsh'. The blockevalis the primarytry/catchmechanism inPerland its hard to write safe code without it.当您需要“生成”并执行代码时使用 Eval。我所说的生成是指从外部源（文件、网站、“代理”）包含以及在程序内动态创建。
除了外部模块和评估站点的明显示例之外，您想要生成代码的原因通常是动态引用代码中的对象和属性的名称。
顺便说一句，第一个示例在加载 HTML 页面并具有脚本标记时，或者在 HTML 标记的事件处理程序属性中已经发生 - 因此，从一开始，Web 开发人员就在利用 EVAL，即使它是浏览器拨打电话。
这间接地让我想到了第二个原因——访问对象的名称。在某些语言（例如 java）中，内省的能力减少或消除了使用 java 的 eval 的需要。事实证明，由于 Javascript 中的对象是完全动态的，因此 Javascript 中的属性访问与其他语言中的内省相当，您可以在其中访问和引用即时创建的名称。此外，Javascript 还具有“call”和“apply”函数，可以通过函数的参数动态调用函数。
最后，与执行代码相关，可以使用 eval 来提高性能——而不是使用多级条件或属性访问来确定要运行的代码或要使用的对象，而是可以创建可能必须执行的最小代码片段数十万次，将其评估为函数，然后调用该函数。例如，一旦确定了所使用的特定参数，这可能适用于多种方法。不过，诚然，这是一个很少见的原因，因为 javascript 将函数视为第一类对象。
Eval is used when you need to 'generate' and execute code. And by generate I mean include from an external source (a file, a website, an 'agent') as well as create on the fly inside the program.
And the reason you would want to generate code, aside from the obvious examples of external modules and evaluation sites, is usually to dynamically reference the names of objects and properties in code.
The first example, btw, already happens when an HTML page is loaded and has a script tag, or in the event handler attributes of HTML tags -- so right from the start a web developer is taking advantage of EVAL, even if it's the browser making the call.
Which indirectly brings me to that second reason -- accessing the names of objects.. In some languages such as java, the ability to introspect reduces or eliminates the need to use java's eval. Turns out that since objects in Javascript are fully dynamic, a property access in Javascript is comparable to introspection in other languages, where you can access and refer to names created on the fly. In addition, Javascript has the 'call' and 'apply' functions to dynamically call functions with their parameters.
Lastly, related to executing code, one might use eval to increase performance -- instead of a multi level conditional or property access that determines which code to run or which object to use, one might create a minimal code snippet that might have to be executed hundreds of thousands of times, eval it to a function, and then just call that function. This might work with multimethods, for example, once the the particular arguments in use are determined. Granted, though, this is a few and far between reason since javascript treats functions as first class objects.
用于在以正确的方式实现想法之前对其进行调试/测试。
例如，您正在制作一个玩具计算器，并且您想首先在 GUI 上工作，因此您只需使用
eval在后台完成“后端”工作。稍后，您回到后端，从头开始eval，并编写适当的表达式解析器。For debugging/testing an idea before implementing it the proper way.
For instance, you're making a toy calculator, and you want to work on the gui first, so you just use
evalto do the "back-end" work in the background. Later, you come back to the back-end, scratcheval, and write a proper expression parser.创建/测试代码段时 eval 是完美的！
只需构建一个带有文本区域和评估按钮的基本脚手架网页即可。
将代码放入文本区域，然后按 eval 按钮。 之间来回切换要快。
它比在文本编辑器和浏览器eval
切换方法
当对代码进行大量测试和调整时，微小的额外步骤确实会增加。另外，您可能会忘记在测试时避免造成混乱。
When creating/testing code segments eval is PERFECT!
Just build a basic scaffolding webpage with textareas and an eval button.
Put code into a textarea then press eval button. It's faster than switching back and forth between your text editor and browser
eval
switching method
When doing alot of testing and tweaking on the code the minor extra steps can really add up. Plus you might forget to save creating confusion when testing.