[python] The difference between eval and ast.literal_eval

eval

Used to execute a string expression and return the value of the expression.

input_ = eval(input('Provide some data here: '))
# 如果输入下面的字符串且被执行，非常危险
__import__('os').system('rm -rf /a-path-you-really-care-about')

ast.literal_eval

Safely evaluates an expression node or string containing a Python literal or container display. The provided string or node may only consist of the following Python literal structures: string, bytes, number, tuple, list, dict, set, boolean, None, bytes, and set.

ref:

• Using python’s eval() vs. ast.literal_eval()
• Eval really is dangerous