# Safe alternatives to ToExpression

### Background

Conversion from string/boxes to expression is quite common. Very often the goal would be a simple switch from "1" to 1. Or "foo" to foo

Mindless ToExpression can lead to evaluation caused by unexpected input or by someone's bad will. E.g. 1 + ToExpression["1"] is fine but 1 + ToExpression["Quit[]"] not anymore.

Symbol[str] /. Verbatim[Symbol][_String] -> $Failed  ### Questions What other alternatives are there? What if there is no alternative and we need to cook up a custom interpreter? Can we do better than: Interpreter["Integer"] @ "Evaluate @ Print[1]"  or ToExpression["1+1", StandardForm, HoldComplete] // Replace[HoldComplete[Except[_Integer]] -> {$Failed}] // First

• The plan is that I will gather given answers in the question as an index. – Kuba May 4 '18 at 12:37
• Already +1 for addressing such a vital problem! – Henrik Schumacher May 4 '18 at 12:58
• I have a feeling that I asked about something similar before, but I can't find it ... This is related: mathematica.stackexchange.com/q/72507/12 For symbols, there's Symbol. For numbers, I do not think there is an alternative that is safe, fast, and robust. FromDigits is safe, but not robust (use it on strings). ToExpression is fast, but not safe or robust. InternalStringToDouble is fast, but not robust (no error reporting). Interpeter can do a lot, it is safe, and I think it is robust. But it is awfully slow. Finally, we could simply use Read and StringToStream. – Szabolcs May 4 '18 at 13:32
• I think that the lack of a good solution is just another manifetation of Wolfram not caring about developers. Mathematica is for interactive use. Want to develop robust and high quality packages? Forget about it. It's a real pain. Why they renamed Mathematica to "Wolfram Language" to "attract programmers" is then beyond me. – Szabolcs May 4 '18 at 13:33

This is too long to fit in a comment so I post it as an answer, sorry.

The last example provided in the question seems already very effective and useful to me. What are the shortcomings of this method that made you look for a different one? Is it unsafe? Not generic enough? Too slow?

It can also be extended to allow for more heads, like:

ToExpressionSafer[string_String] := ReleaseHold@Replace[
ToExpression[string, StandardForm, HoldComplete],
{h : _Plus | _Times | _Integer | _Real :> h, _ -> $Failed}, Infinity ] In[]:= ToExpressionSafer["1+2"] (* 3 *) In[]:= ToExpressionSafer["1+2*4+8.5"] (* 17.5 *) In[]:= x = 100; ToExpressionSafer["1+x"] (* 1 +$Failed *)

In[]:= ToExpressionSafer["Quit[]"]
(*\$Failed*)


Some timings:

ToExpressionSafer["12.5"]; // TimeIt
(* 4.9 * 10^-5 *)

ToExpression["12.5"]; // TimeIt
(* 5.9 * 10^-6 *)

InternalStringToDouble["12.5"]; // TimeIt
(* 4.0 * 10^-7 *)


For this simple string to real conversion, the methods become one order of magnitude slower for each increase in complexity and error checking. That seems quite reasonable to me.

• I was hoping that there are more than InternalStringToDouble, to list them and to compare pros and cons. General solution would be nice too as it is hard to expect to find all variations built-in. And such function should take a string and a type/pattern which is expected to be found. p.s. TimeIt` is not defined. – Kuba May 7 '18 at 7:51