title: Python: make eval safe
body: <p>I want an easy way to do a "calculator API" in Python.</p>
  
  <p>Right now I don't care much about the exact set of features the calculator is going to support.</p>
  
  <p>I want it to receive a string, say <code>"1+1"</code> and return a string with the result, in our case <code>"2"</code>.</p>
  
  <p>Is there a way to make <code>eval</code> safe for such a thing? </p>
  
  <p>For a start I would do </p>
  
  <pre><code>env = {}
  env["locals"]   = None
  env["globals"]  = None
  env["__name__"] = None
  env["__file__"] = None
  env["__builtins__"] = None
  
  eval(users_str, env)
  </code></pre>
  
  <p>so that the caller cannot mess with my local variables (or see them).</p>
  
  <p>But I am sure I am overseeing a lot here. </p>
  
  <p>Are <code>eval</code>'s security issues fixable or are there just too many tiny details to get it working right?</p>