When should I use eval (taking a string and executing it as code at runtime)?

Question

I've often heard the argument (in javascript, but many languages have an eval-like feature) that using eval is "bad." The arguments being that most things you would think to use eval for can be done other ways, the fact that eval is very slow in most cases, and that it can allow users to input code to be executed (if proper precaution wasn't taken). We know that most features aren't just inherently "bad", but lets but the spotlight on eval,

What are some of eval's valid uses? (besides offering a nice feature for developers debugging the application)

Answer 1

A read-eval-print loop would usually be implemented using eval.

Answer 2

eval() has good and bad points. The worst aspect of eval in any language that supports it is that it opens the door wide for security holes. If an exploiter can figure out how to get any custom code he writes into an eval statement in your application then he probably has the ability to do all sorts of nefarious things like steal private data or disable services that your application provides. Performance is another concern which you already voiced.

Eval really shines in areas where your code may need to dynamically generate other code to perform a complex task easily. I can't think of an example right now but any case where you needed to do this is probably not going to be trivial. I'd recommend doing this only when absolutely necessary to minimize the risk of the point i made in the previous paragraph though. If possible, never trust user input as safe enough to use eval with.