October 30, 2017

Vulnerability of input() in Python 2.x

input function in Python 2.x

I created the variables "str1" and "str2". "input()" receives user's input data and stores it in "str1" then "print" prints the value and the type.




input function's return value in Python 2.x

The type of the return value of "input()" depends on the input value. Without the double quotes, Python can be problematic because it understands the input value as a variable or a function name. Even if the programmer didn't intend using the "str2" as variable, but someone can exploit it.

Therefore, it is better to use "raw_input()" which returns str type.