# Code Injection (eval / dynamic execution)

> Detects user-controlled input passed to code evaluation functions like eval, exec, or dynamic code generation.

- Skill: `zakirkun/code-injection-eval-dynamic-execution` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/code-injection-eval-dynamic-execution`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/code-injection-eval-dynamic-execution/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/code-injection-eval-dynamic-execution

---


# Code Injection

## Overview
Code injection occurs when user-controlled input is executed as code by the application. This differs from Command Injection (OS commands) and SQL Injection — the attacker's input is evaluated by the application's own interpreter.

Common functions to avoid with user input:
- Python: `eval()`, `exec()`, `compile()`
- PHP: `eval()`, `assert()` with string argument, `preg_replace()` with `/e`
- JavaScript: `eval()`, `new Function()`, `setTimeout(string)`
- Ruby: `eval()`, `binding.eval()`, `instance_eval`

## Remediation
- Never pass user input to code evaluation functions
- Use data structures and lookup tables instead of dynamic code evaluation