Parsing an expression built from concatenated input allows SpEL or OGNL injection.
Never evaluate expressions built from user input; use a fixed expression with bound variables.