How do I execute a string containing Python code in Python?
-
8To be fair, unlike the other question, this one isn't a duplicate. And others have posted much more basic questions than this.– DNSMar 31, 2009 at 16:25
-
14The correct answer, of course, is almost always “don't!”.– bobinceMar 31, 2009 at 16:28
-
26@S. Lott: Haven't read the FAQ recently? "It's also perfectly fine to ask and answer your own programming question, but pretend you're on Jeopardy: phrase it in the form of a question". This is not a bad question. +1– Devin JeanpierreMar 31, 2009 at 17:48
-
59@S.Lott: You don't. You don't need to. If the question isn't on the site already, then it's fair game (according to the FAQ, as already pointed out). Just answer every question as though the OP needs help. They might not, but the next guy who reads their question probably will. Just my 2 cents.– Bill the LizardApr 2, 2009 at 18:13
-
2To all you saying not to do it: I have a case where I absolutely need to. It involves distributed processing.– sudoAug 1, 2016 at 8:23
14 Answers
For statements, use exec(string)
(Python 2/3) or exec string
(Python 2):
>>> mycode = 'print "hello world"'
>>> exec(mycode)
Hello world
When you need the value of an expression, use eval(string)
:
>>> x = eval("2+2")
>>> x
4
However, the first step should be to ask yourself if you really need to. Executing code should generally be the position of last resort: It's slow, ugly and dangerous if it can contain user-entered code. You should always look at alternatives first, such as higher order functions, to see if these can better meet your needs.
-
1but how about the scope of the code executed by 'exec'? is it nested? Mar 6, 2012 at 10:24
-
27A common case where someone wants to use 'exec' is something like
if s=='foo': x.foo = 42 elif s=='bar': x.bar = 42
etc, which they may then write asexec ("x.%s = 42" % s)
. For this common case (where you only need to access an object's attribute that is stored in a string), there is a much faster, cleaner and safer functiongetattr
: just writegetattr(x, s) = 42
to mean the same thing. Apr 19, 2012 at 19:18 -
7
-
7@ShreevatsaR don't you mean
setattr(x, s, 42)
? I triedgetattr(x, 2) = 42
and it failed withcan't assign to function call: <string>, line 1
Oct 11, 2013 at 17:44 -
7@Tanner: Hmm. Yes indeed
setattr(x, s, 42)
is the right syntax. Surprised it took so long for that error to be caught. Anyway, the point is thatgetattr
andsetattr
are an alternative toexec
when all you want is to get an arbitrary member, looked up by string. Oct 11, 2013 at 19:01
In the example a string is executed as code using the exec function.
import sys
import StringIO
# create file-like string to capture output
codeOut = StringIO.StringIO()
codeErr = StringIO.StringIO()
code = """
def f(x):
x = x + 1
return x
print 'This is my output.'
"""
# capture output and errors
sys.stdout = codeOut
sys.stderr = codeErr
exec code
# restore stdout and stderr
sys.stdout = sys.__stdout__
sys.stderr = sys.__stderr__
print f(4)
s = codeErr.getvalue()
print "error:\n%s\n" % s
s = codeOut.getvalue()
print "output:\n%s" % s
codeOut.close()
codeErr.close()
-
3swapping out stdout and stderr like that make me very nervous. this looks like it could cause huge security problems. is there a way around that? May 23, 2011 at 13:33
-
3@Narcolapser you should be mych more concerned with using
exec
at all (unless you know the code string comes from a trusted source). Dec 2, 2019 at 17:00
eval
and exec
are the correct solution, and they can be used in a safer manner.
As discussed in Python's reference manual and clearly explained in this tutorial, the eval
and exec
functions take two extra parameters that allow a user to specify what global and local functions and variables are available.
For example:
public_variable = 10
private_variable = 2
def public_function():
return "public information"
def private_function():
return "super sensitive information"
# make a list of safe functions
safe_list = ['public_variable', 'public_function']
safe_dict = dict([ (k, locals().get(k, None)) for k in safe_list ])
# add any needed builtins back in
safe_dict['len'] = len
>>> eval("public_variable+2", {"__builtins__" : None }, safe_dict)
12
>>> eval("private_variable+2", {"__builtins__" : None }, safe_dict)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<string>", line 1, in <module>
NameError: name 'private_variable' is not defined
>>> exec("print \"'%s' has %i characters\" % (public_function(), len(public_function()))", {"__builtins__" : None}, safe_dict)
'public information' has 18 characters
>>> exec("print \"'%s' has %i characters\" % (private_function(), len(private_function()))", {"__builtins__" : None}, safe_dict)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<string>", line 1, in <module>
NameError: name 'private_function' is not defined
In essence you are defining the namespace in which the code will be executed.
-
12It is not possible to make eval safe: Eval really is dangerous. If you take code from me and eval it, I can segfault your Python program. Game over. Feb 18, 2013 at 4:20
-
5@v.oddou I was responding to alan's statement, "eval and exec .. can be used in a safe manner." This is false. If someone said, "bash can be used in a safe manner," that would also be false. Bash is dangerous. It is a necessary danger, but dangerous nevertheless. Claiming that eval can be made safe is simply wrong. Jan 13, 2015 at 15:10
-
1@NedBatchelder yes indeed. and the link you point to is good material. with power comes responsibility, so the point is simply to be aware of the potential power of eval. and if we decide that power=danger.– v.oddouJan 14, 2015 at 2:08
-
4@NedBatchelder Many pieces of code written in Python can be dangerous as well, but why are you assuming that
eval
orexec
are intended to be used asexec(input("Type what you want"))
? There are many cases where a program may write a procedure or a function as a result of a computation; resulting functions will be as safe and as fast (once evaluated) as any other part of a good and well-written program. An unsafe program containingexec
is not more dangerous than an unsafe program doing the damage by itself asexec
doesn't give any new privilege to the program. Nov 16, 2016 at 10:46 -
1@ThomasBaruchel again, my point is to counter the notion that eval or exec can be made safe. In particular, this answer claims that controlling the globals and locals will make it possible to use them safely. That is false. Any time you use exec and eval, you have to know precisely what code is being executed. If you don't, then you are open to dangerous operations. Nov 16, 2016 at 23:10
Remember that from version 3 exec
is a function!
so always use exec(mystring)
instead of exec mystring
.
Avoid exec
and eval
Using exec
and eval
in Python is highly frowned upon.
There are better alternatives
From the top answer (emphasis mine):
For statements, use
exec
.When you need the value of an expression, use
eval
.However, the first step should be to ask yourself if you really need to. Executing code should generally be the position of last resort: It's slow, ugly and dangerous if it can contain user-entered code. You should always look at alternatives first, such as higher order functions, to see if these can better meet your needs.
From Alternatives to exec/eval?
set and get values of variables with the names in strings
[while
eval
] would work, it is generally not advised to use variable names bearing a meaning to the program itself.Instead, better use a dict.
It is not idiomatic
From http://lucumr.pocoo.org/2011/2/1/exec-in-python/ (emphasis mine)
Python is not PHP
Don't try to circumvent Python idioms because some other language does it differently. Namespaces are in Python for a reason and just because it gives you the tool
exec
it does not mean you should use that tool.
It is dangerous
From http://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html (emphasis mine)
So eval is not safe, even if you remove all the globals and the builtins!
The problem with all of these attempts to protect eval() is that they are blacklists. They explicitly remove things that could be dangerous. That is a losing battle because if there's just one item left off the list, you can attack the system.
So, can eval be made safe? Hard to say. At this point, my best guess is that you can't do any harm if you can't use any double underscores, so maybe if you exclude any string with double underscores you are safe. Maybe...
It is hard to read and understand
From http://stupidpythonideas.blogspot.it/2013/05/why-evalexec-is-bad.html (emphasis mine):
First,
exec
makes it harder to human beings to read your code. In order to figure out what's happening, I don't just have to read your code, I have to read your code, figure out what string it's going to generate, then read that virtual code. So, if you're working on a team, or publishing open source software, or asking for help somewhere like StackOverflow, you're making it harder for other people to help you. And if there's any chance that you're going to be debugging or expanding on this code 6 months from now, you're making it harder for yourself directly.
-
1"my best guess is that you can't do any harm if you can't use any double underscores" - You could construct a string containing double underscores, and then call eval that string. Oct 11, 2016 at 16:11
-
1good advice, unless you are writing a code generator, or job runner or similar ... which most people here are probably doing. May 3, 2019 at 12:59
-
1I have to import a relative path from a config-file (
cfg.yaml
):reldir : ../my/dir/
, andreldir = cfg[reldir]
. However, as this python code shall run on both Windows and Linux, I need this to adjust to the different operating systems path dividers; either\\
or/
. So I usereldir : os.path.join('..','my','dir')
in the config file. But this only results inreldir
being this literal string, not being evaluated, so I cannot open a file inreldir
. Do you have a suggestion? Mar 11, 2020 at 14:18 -
eval()
is just for expressions, while eval('x+1')
works, eval('x=1')
won't work for example. In that case, it's better to use exec
, or even better: try to find a better solution :)
It's worth mentioning, that' exec
's brother exist as well called execfile
if you want to call a python file. That is sometimes good if you are working in a third party package which have terrible IDE's included and you want to code outside of their package.
Example:
execfile('/path/to/source.py)'
or:
exec(open("/path/to/source.py").read())
You accomplish executing code using exec, as with the following IDLE session:
>>> kw = {}
>>> exec( "ret = 4" ) in kw
>>> kw['ret']
4
-
5
As the others mentioned, it's "exec" ..
but, in case your code contains variables, you can use "global" to access it, also to prevent the compiler to raise the following error:
NameError: name 'p_variable' is not defined
exec('p_variable = [1,2,3,4]')
global p_variable
print(p_variable)
I tried quite a few things, but the only thing that worked was the following:
temp_dict = {}
exec("temp_dict['val'] = 10")
print(temp_dict['val'])
output:
10
-
2After trying most of the above methods , this is the only one that worked. Gracias– Brad123Mar 4 at 18:33
The most logical solution would be to use the built-in eval() function .Another solution is to write that string to a temporary python file and execute it.
Ok .. I know this isn't exactly an answer, but possibly a note for people looking at this as I was. I wanted to execute specific code for different users/customers but also wanted to avoid the exec/eval. I initially looked to storing the code in a database for each user and doing the above.
I ended up creating the files on the file system within a 'customer_filters' folder and using the 'imp' module, if no filter applied for that customer, it just carried on
import imp
def get_customer_module(customerName='default', name='filter'):
lm = None
try:
module_name = customerName+"_"+name;
m = imp.find_module(module_name, ['customer_filters'])
lm = imp.load_module(module_name, m[0], m[1], m[2])
except:
''
#ignore, if no module is found,
return lm
m = get_customer_module(customerName, "filter")
if m is not None:
m.apply_address_filter(myobj)
so customerName = "jj" would execute apply_address_filter from the customer_filters\jj_filter.py file
-
1How did you manage security? How do you know customers won't abuse this privilege?– JSBachMay 14, 2017 at 15:19