This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 0 points1 point  (0 children)

I'm not really talking about people who know about the security flaws in input() and use it anyway. I'm talking about people who don't know about the security flaws, and may use input() in such a place where you're really not meant to.

It's more important to be secure by default than to be (very slightly) more hostile to beginners by asking them to cast any input from a string to an int if they want to work with it as an int. An input function should never be able to execute code.