分享兴趣，传播快乐，增长见闻，留下美好！
亲爱的您，这里是LearningYard新学苑。
今天小编为大家带来文章
“Python中的eval()函数”
欢迎您的访问。
Share interest, spread happiness, increase knowledge, leave a beautiful!
Dear, this is LearningYard Academy.
Today Xiaobian brings you an article
“The eval() function in Python”
Welcome to your visit.
杨帆学海（3）：Python中的eval()函数（The eval() function in Python.）
在Python的众多函数中， eval() 是一个独特且功能强大的存在。它就像一把万能钥匙，能解锁很多复杂问题，但同时，使用不当也可能带来意想不到的风险。
Among the many functions in Python, eval() stands out as a unique and powerful one. It's like a master key that can unlock many complex problems, but at the same time, improper use can also bring unexpected risks.
一、eval()函数是什么
eval() 函数的官方定义是：将字符串作为Python表达式进行解析和计算，并返回计算结果。简单来说，它可以把一个包含Python表达式的字符串当作真实的Python代码来执行，并返回执行后的结果。其语法结构非常简洁： eval(expression, globals=None, locals=None) ，其中 expression 是要被解析和计算的字符串表达式， globals 和 locals 是可选参数，分别用于指定全局命名空间和局部命名空间。
The official definition of the eval() function is: it parses and evaluates a string as a Python expression and returns the result of the computation. Simply put, it can execute a string containing a Python expression as if it were actual Python code and return the result after execution. Its syntax structure is very concise: eval(expression, globals=None, locals=None), where expression is the string expression to be parsed and evaluated, and globals and locals are optional parameters used to specify the global and local namespaces, respectively.
二、eval()函数的常见使用场景
1.数学计算
在处理数学表达式时， eval() 函数特别方便。假如我们有一个字符串表示的数学式子，比如 "3 + 5 * 2" ，正常情况下，这个字符串只是一串字符，无法直接进行数学运算。但通过 eval() 函数，就能轻松实现计算。
When dealing with mathematical expressions, the eval() function is particularly convenient. If we have a mathematical equation represented as a string, such as "3 + 5 * 2", normally this string is just a sequence of characters and cannot be directly used for mathematical computation. However, with the eval() function, we can easily perform the calculation.
运行这段代码，输出结果是 13 ， eval() 函数准确地计算出了表达式的值，就像我们在Python交互式环境中直接输入 3 + 5 * 2 一样。
Running this code will produce the output 13, as the eval() function accurately computes the value of the expression, just as if we had directly entered 3 + 5 * 2 in the Python interactive environment.
2.动态执行代码
eval() 函数还能实现动态执行代码。例如，当我们需要根据用户输入的不同，动态执行不同的Python代码片段时， eval() 就派上用场了。假设用户输入一个简单的函数调用字符串，如 "abs(-5)" ，我们可以使用 eval() 来执行这个函数调用：
The eval() function can also execute code dynamically. For example, when we need to execute different Python code snippets dynamically based on user input, eval() comes in handy. Suppose the user inputs a simple function call string, such as "abs(-5)", we can use eval() to execute this function call.
运行后，输出 5 ，成功调用了 abs() 函数并得到正确结果。
After running it, the output is 5, successfully calling the abs() function and getting the correct result.
三、eval()函数的潜在风险
虽然 eval() 函数功能强大，但它也存在一定风险。由于 eval() 会将传入的字符串当作Python代码执行，这就意味着如果传入的字符串来自不可信的来源（比如用户输入），恶意用户可能会输入恶意代码，导致程序被攻击。例如：
Although the eval() function is powerful, it also carries certain risks. Since eval() executes the passed-in string as Python code, this means that if the string comes from an untrustworthy source (such as user input), a malicious user might input malicious code, causing the program to be attacked. For example:
一旦执行这段代码，后果不堪设想，当前目录下的所有文件都会被删除。所以，在使用 eval() 函数时，一定要确保传入的字符串来源可靠。
Once this code is executed, the consequences could be catastrophic, as all files in the current directory will be deleted. Therefore, when using the eval() function, it is essential to ensure that the string passed in comes from a reliable source.
四、安全替代方案
为了避免 eval() 函数带来的安全风险，在很多情况下可以使用更安全的替代方案。例如，在进行简单的数学计算时，可以使用 ast.literal_eval() 函数。它和 eval() 类似，但 ast.literal_eval() 只会计算包含Python字面量（如数字、字符串、元组、列表、字典等）的表达式，对于函数调用、导入模块等危险操作会抛出异常，从而保证了安全性。
To avoid the security risks associated with the eval() function, safer alternatives can be used in many cases. For example, when performing simple mathematical calculations, the ast.literal_eval() function can be used. It is similar to eval(), but ast.literal_eval() only evaluates expressions containing Python literals (such as numbers, strings, tuples, lists, dictionaries, etc.), and will raise exceptions for dangerous operations like function calls and module imports, thereby ensuring safety.
这段代码同样能得到正确的计算结果 13 ，但却避免了潜在的安全风险。
This code can also obtain the correct calculation result of 13, but it avoids potential security risks.
eval() 函数是Python中一把双刃剑，它为我们提供了强大的动态执行能力，但也伴随着安全隐患。在使用时，我们要充分了解其特性，谨慎使用，确保程序的安全与稳定。
The eval() function is a double-edged sword in Python, providing us with powerful dynamic execution capabilities but also coming with security risks. When using it, we must fully understand its characteristics, use it cautiously, and ensure the safety and stability of the program.
参考资料：文心一言
参考文献：[1]嵩天,礼欣,黄天羽. Python语言程序设计基础(第2版) [M]. 北京:高等教育出版社,2017:29-32.
本文由LearningYard新学苑原创，如有侵权请在后台留言！
文案|yang
排版|yang
审核|yue