title: Prevent "input" function from calling functions or accessing variables
body: <p>Considering the following code</p>
  <pre><code>x = input('Input an array: ');
  </code></pre>
  <p>If the user types <code>[1 2 3]</code>, variable <code>x</code> will be assigned that numeric vector. Similarly, if they type <code>{1, [2 3], 'abc'}</code>, variable <code>x</code> will be a cell array containing those values. Fine.</p>
  <p>Now, if the user types <code>[sqrt(2) sin(pi/3)]</code>, variable <code>x</code> will be assigned the resulting values: <code>[1.414213562373095 0.866025403784439]</code>. That's because the provided data is <strong>evaluated</strong> by <a href="http://es.mathworks.com/help/matlab/ref/input.html" rel="nofollow noreferrer"><code>input</code></a>:</p>
  <blockquote>
  <p><code>input</code> Prompt for user input. <br>
  <code>result = input(prompt)</code> displays the <code>prompt</code> string on the screen, waits
  for input from the keyboard, <strong>evaluates any expressions in the input</strong>,
  and returns the value in <code>result</code>. [...]</p>
  </blockquote>
  <p>This can cause problems. For example, what happens if the user types <code>addpath('c:\path\to\folder')</code> as input? Since the input is evaluated, it's actually a
  command which will be executed by Matlab. So the user can get to add a folder to the path. Worse yet, if they input <code>path('')</code>, the path will be effectively changed to nothing, and Matlab will stop working properly.</p>
  <p>Another potential source of problems is that</p>
  <blockquote>
  <p>[...] To evaluate expressions, <code>input</code> <strong>accesses variables in the current workspace</strong>.</p>
  </blockquote>
  <p>For example, if the user inputs <code>fprintf(1,'%f', varname)</code> and <code>varname</code> is an existing numeric array, the user will know its current value.</p>
  <p>This behaviour is probably by design. Users of a Matlab program are trusted when inputting data, much like they are trusted not to press <kbd>Control</kbd>-<kbd>C</kbd> to halt the program (and then issue all commands or inspect all variables they like!).</p>
  <p>But in certain cases the programmer may want to have a more &quot;secure&quot; <code>input</code> function, by which I mean</p>
  <ol>
  <li><strong>prevent any function calls when evaluating user
  input</strong>; and</li>
  <li><strong>prevent the input from accessing variables of the program</strong>.</li>
  </ol>
  <p>So <code>[1 2]</code> would be valid input, but <code>[sqrt(2) sin(pi/3)]</code> or <code>path('')</code> would not because of item 1; and <code>[1 2 3 varname(1)]</code> would be invalid too because of item 2.</p>