Also: don't eval() user-supplied strings.