That's the point. That just checking for occurrences of strings like 'eval' just gives you false sense of security.