[zimmund]

I've seen `eval()` in production code of several applications. The biggest vulnerability is more often than not the programmer :)

[ovex]

But `eval()` does not violate a programmer's intuition as easily as an arithmetic expression resulting in code execution.