eval() executes a string of characters as code. You use
eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need
In that sense, code generators (and thus
eval()) incur the same conceptual issues as raw SQL and its consequence, SQL injection attacks. Assembling at runtime an SQL request from externally provided parameters can be done securely, but this requires minding an awful lot of details, so the usual advice is not to do that. This relates to the usual conundrum of security, i.e. that it is not testable: you can test whether some piece of code works properly on correct data, but not that it never works improperly on incorrect data. Similarly, using
eval() securely is possible, but it is so hard in practice that it is discouraged.
All of this is said in all generality. In your specific context,
eval() might be safe. However, it takes some effort to have a context safe for use of
eval(), that actually needs