Dynamic Code Execution

eval, exec, and compile

Three builtins form the dynamic-execution toolkit:

code = compile("1 + 2", "<calc>", "eval")   # → code object; modes: eval/exec/single
eval(code)                                  # expressions only → returns 3
eval("x + 1", {"x": 10})                    # globals dict supplies names

exec("y = 5")                               # statements → returns None, side effects only
d = {}
exec("y = 5", d); d["y"]                    # 5 — result lands in the dict

eval demands an expression and yields its value; exec accepts statements (defs, loops, imports) and yields None. compile separates parsing from execution — precompile hot snippets once, then eval the code object repeatedly. eval also accepts an exec-mode code object only through exec; the reverse fails with a SyntaxError.

Scope Inside Functions

exec inside a function cannot write local variables — the compiler decided the function’s fast locals before the string ran:

def f():
    exec("a = 1")        # a does NOT appear here
    return locals().get("a")      # depends on the dict passed in

def g():
    scope = {}
    exec("a = 1", scope)          # explicit dict = reliable channel
    return scope["a"]

Pass a single dict as both globals and locals and assignments become visible to code sharing that dict:

scope = {"__builtins__": {}}
exec("result = sum(values)", scope)   # scope["result"] after run

Two dicts (globals separate from locals) send assignments only to the locals mapping — reads still see globals, which produces confusing partial environments. Prefer explicit data flow over exec-driven name injection.

Security and Safe Alternatives

Never evaluate untrusted input. There is no reliable sandbox: even with {"__builtins__": {}}, reachable objects lead to subclasses of object and then to ().__class__.__mro__[1].__subclasses__(), which exposes file and process primitives. Every "restricted eval" has been escaped.

Safe substitutions:

Interview angle: say plainly that eval executes arbitrary code with the caller’s privileges, show ast.literal_eval as the narrow exception, and name one real-world incident class (template/config injection).