[ajanuary]

Can you give an example of your last point?

A language like Ruby will only perform interpolation on string literals, so there isn't a way (that I know of) for data to inject interpolated strings.

Interpolation isn't the same thing as eval.

[NateDad]

I guess that's my lack of knowledge of how Ruby's string interpolation works. I assumed it worked like any old string format, which in other languages can use whatever string is passed into the formatting function. It sounds like that's not the case for Ruby's string interpolation. My apologies for jumping to conclusions. I guess it's my statically compiled mindset that assumes a string is a string.

[ajanuary]

You can kind of think of it as syntactic sugar over adding strings that desugars at the compilation stage.

"abc #{x} def" would desugar to "abc"+x+"def"

Because it's happening at the compilation stage, it can only be done on string literals (which as we've seen is actually an advantage security wise).

The reality is actually a tad more complicated, because you can make efficiency improvements and only create one string instead of all the intermediate strings etc. but the effect is the same.