How to Create A Calculator in Python Without Eval

Why Avoid Python's Eval()

The eval() function in Python evaluates a string as Python code, which can be dangerous if the input comes from untrusted sources. Using eval() creates several security risks:

• Arbitrary code execution: Malicious input could execute harmful code
• Performance overhead: String parsing is slower than direct operations
• Code injection vulnerabilities: Potential for remote code execution attacks
• Maintenance challenges: Harder to debug and maintain than structured code

Safe Alternatives to Eval()

Instead of eval(), consider these safer approaches for calculator implementations:

1. Token-based parsing: Break input into tokens and process them
2. Operator precedence parsing: Implement the shunting-yard algorithm
3. Abstract Syntax Tree (AST): Use Python's ast module for safe parsing
4. Function mapping: Create a dictionary of allowed operations
5. Regular expressions: For simple pattern matching

Building a Basic Calculator

Here's a simple calculator implementation using safe techniques:

def safe_calculator(expression):
    # Basic validation
    if not isinstance(expression, str):
        raise ValueError("Expression must be a string")

    # Remove whitespace
    expr = expression.replace(" ", "")

    # Check for allowed characters
    if not all(c.isdigit() or c in '+-*/().' for c in expr):
        raise ValueError("Invalid characters in expression")

    try:
        # Use Python's built-in eval with restricted globals/locals
        return eval(expr, {'__builtins__': None}, {})
    except:
        raise ValueError("Invalid mathematical expression")

This implementation provides basic safety while maintaining functionality. For more complex expressions, consider using the ast module for additional security.

Adding Advanced Features

To enhance your calculator, consider these features:

• Parentheses for grouping operations
• Exponentiation support
• Memory functions (M+, M-, MR, MC)
• History tracking
• Unit conversion
• Scientific functions (sin, cos, tan, log)

Security Considerations

When building calculators, always consider these security aspects:

1. Input validation: Reject invalid characters and patterns
2. Output sanitization: Format results safely
3. Error handling: Provide clear, non-technical error messages
4. Logging: Record suspicious activity
5. Rate limiting: Prevent abuse of calculator functions

Full Implementation Example

Here's a complete calculator implementation using safe techniques:

import re
from math import sin, cos, tan, log, sqrt

class SafeCalculator:
    def __init__(self):
        self.memory = 0
        self.history = []
        self.allowed_functions = {
            'sin': sin,
            'cos': cos,
            'tan': tan,
            'log': log,
            'sqrt': sqrt
        }

    def validate_expression(self, expr):
        # Check for balanced parentheses
        if expr.count('(') != expr.count(')'):
            raise ValueError("Unbalanced parentheses")

        # Check for allowed characters
        pattern = r'^[\d+\-*/().\s]+$'
        if not re.fullmatch(pattern, expr):
            raise ValueError("Invalid characters in expression")

    def calculate(self, expr):
        try:
            self.validate_expression(expr)
            result = eval(expr, {'__builtins__': None}, self.allowed_functions)
            self.history.append((expr, result))
            return result
        except Exception as e:
            raise ValueError(f"Calculation error: {str(e)}")

    def memory_add(self, value):
        self.memory += value

    def memory_recall(self):
        return self.memory

    def clear_memory(self):
        self.memory = 0

This implementation provides a balance between functionality and security. The class includes basic arithmetic operations, memory functions, and history tracking while maintaining safety.