Hacker News Reader

More like "the danger of thinking you can trivially validate user-supplied input" before evaluating the string.

Even non-trivially validating it can go wrong. See Log4Shell, e.g.

The bigger problem here is executing user input.