title: Why should exec() and eval() be avoided?
body: <p>I've seen this multiple times in multiple places, but never have found a satisfying explanation as to why this should be the case. </p>
  
  <p>So, hopefully, one will be presented here. Why should we (at least, generally) not use <code>exec()</code> and <code>eval()</code>?</p>
  
  <p>EDIT: I see that people are assuming that this question pertains to web servers – it doesn't. I can see why an unsanitized string being passed to <code>exec</code> could be bad. Is it bad in non-web-applications?</p>