Instead of hacking around eval(), which everyone knows is a bad idea even with prior expression sanitizing.