Hacker News new | ask | show | jobs
by cmacleod4 620 days ago
No more so than any other dynamic language. Of course if you execute untrusted input you are asking for trouble. But Tcl has very well-defined rules for how and when substitutions and evaluations will be performed - https://www.tcl-lang.org/man/tcl/TclCmd/Tcl.htm#M4 - so the programmer has full control.