In Python 2, there were two ways of getting input. raw_input()
and input()
, which was a wrapper around eval(raw_input())
. In Python 3 however, input()
replaced raw_input()
and the old meaing of input()
was deprecated. This is documented in What's new in Python 3:
PEP 3111:
raw_input()
was renamed toinput()
. That is, the newinput()
function reads a line fromsys.stdin
and returns it with the trailing newline stripped. It raisesEOFError
if the input is terminated prematurely. To get the old behavior ofinput()
, useeval(input())
.
But why exactly was input()
around in Python 2 in the first place? What was the rationale for having user input that was evaluated as literal Python 2 code? This is what the Python 2 documentation had to say:
[
input()
is] Equivalent toeval(raw_input(prompt))
.This function does not catch user errors. If the input is not syntactically valid, a
SyntaxError
will be raised. Other exceptions may be raised if there is an error during evaluation.If the
readline
module was loaded, theninput()
will use it to provide elaborate line editing and history features.Consider using the
raw_input()
function for general input from users.
Notice the part in bold (which I emphasized). What exactly does this mean? I looked over the documentation for the readline
module and found a few things. The only real relevant bit I found, however, was this:
Settings made using this module affect the behavior of both the interpreter’s interactive prompt and the prompts offered by the
raw_input()
andinput()
built-in functions.
Which doesn't really help explain why input()
was created or needed in the first place, though.
Needless to say, using eval(any_user_input())
is very dangerous security wise, can cause debugging difficulties, and, from what I've read, is slow. So why did they create input()
in Python 2 in the first place? Were the developers unaware at the time of the downfalls of input()
?
References: