http://maverick.i2p/blog/darknet-dev
Functions like eval, exec, system, popen, shell backticks, runtime compilers, or template engines with code execution are basically loaded guns sitting on your desk. If user input ever flows into them without extreme containment, you are not “at risk”, you are finished . The safest pattern is simple, do not execute dynamic code at all .