instance_eval or class_eval on dynamic input executes arbitrary code in an object or class context.
Do not evaluate user-supplied strings; refactor to call known methods directly.