Evaluate a configurable expression
A trusted, internally generated expression must be computed against a controlled set of names.
Python · Function
eval
eval() evaluates a Python expression from source text or a code object and returns its result. Optional global and local namespaces control name resolution.
How it works
eval() parses source as a Python expression and evaluates it using optional global and local namespaces. If omitted, those namespaces come from the calling environment; the result of the expression is returned.
Syntax
eval(source, /, globals=None, locals=None)Parameters
| Name | Type | Description |
|---|---|---|
expression | str | code object | A Python expression as a string or code object. |
globals | dict | None | The global namespace; when supplied, it must be a dictionary. |
locals | mapping | None | The local namespace; it can be any mapping object. |
Returns
The result of the evaluated expression.
Key points
- The source must represent an expression, rather than an arbitrary sequence of statements.
- Names in the expression are resolved through the supplied global and local namespaces.
- The locals argument accepts mappings beyond ordinary dictionaries.
- With no namespace arguments, evaluation uses the caller's current environment.
- The function returns the value produced by evaluating the expression.
- A compiled code object can be passed instead of source text.
Common mistakes
- Never pass untrusted input to eval(), because the evaluated expression can execute arbitrary code.
- The globals argument must be a dictionary when supplied; locals may use a more general mapping.
- Supplying globals without locals makes both namespaces refer to the same dictionary.
- Invalid expression syntax raises an exception rather than producing a value.
Example: Evaluate an expression with explicit namespaces
expression = "price * quantity"
context = {"price": 12, "quantity": 3}
result = eval(expression, {"__builtins__": {}}, context)
print(result) # 36Evaluates a trusted arithmetic expression with explicitly supplied names and no built-in names.
When to use it
Run compiled expression code
A previously compiled expression needs to be run repeatedly.
Interview questions
QWhat does eval() evaluate and return?
eval() accepts a string or code object representing a Python expression and returns that expression's result. It is not a general statement executor.
Follow-up: How can its available names be controlled? Pass explicit globals and locals mappings, typically restricting globals such as __builtins__.
QHow do omitted namespace arguments affect name resolution?
If globals and locals are omitted, eval() uses the environment at the call site. If only globals is supplied, locals defaults to that same dictionary.
Follow-up: What type must globals have? It must be a dictionary; locals can be any mapping object.
QWhat happens to built-ins in a supplied globals dictionary?
A globals dictionary that lacks __builtins__ receives a reference to the built-in module dictionary before parsing. This means merely passing an otherwise small globals dictionary does not automatically remove built-ins.
Follow-up: What is the security implication? Untrusted source must not be evaluated; use a purpose-built parser or safer data format instead.
Related
compile()exec()__builtins__