title: Using python's eval() vs. ast.literal_eval()
body: <p>I have a situation with some code where <code>eval()</code> came up as a possible solution.  Now I have never had to use <code>eval()</code> before but, I have come across plenty of information about the potential danger it can cause.  That said, I'm very wary about using it.</p>
  <p>My situation is that I have input being given by a user:</p>
  <pre><code>datamap = input('Provide some data here: ')
  </code></pre>
  <p>Where <code>datamap</code> needs to be a dictionary.  I searched around and found that <code>eval()</code> could work this out. I thought that I might be able to check the type of the input before trying to use the data and that would be a viable security precaution.</p>
  <pre><code>datamap = eval(input('Provide some data here: ')
  if not isinstance(datamap, dict):
      return
  </code></pre>
  <p>I read through the docs and I am still unclear if this would be safe or not.  Does eval evaluate the data as soon as its entered or after the <code>datamap</code> variable is called?</p>
  <p>Is the <code>ast</code> module's <code>.literal_eval()</code> the only safe option?</p>