Understanding Python's exec() Function: Syntax, Examples, and Best Practices

exec() is a built‑in Python function that dynamically executes a string of Python code or a compiled code object, optionally accepting custom global and local namespaces to control the execution context.

Syntax

exec(object[, globals[, locals]])

Parameters:

object : the code to execute, either as a string or a compiled code object.

globals (optional): a dictionary representing the global symbol table for the executed code.

locals (optional): a mapping object for the local symbol table; if omitted, it defaults to the same object as globals unless globals is immutable.

Dynamic Execution

The most common use of exec() is to run Python code represented as a string, enabling runtime code generation useful for metaprogramming and advanced debugging.

Examples

Basic usage:

code = """
 x = 10
 print('The value of x is:', x)
"""
exec(code)
# Output: The value of x is: 10

Using custom global and local namespaces:

global_dict = {"a": 1}
local_dict = {"b": 2}
exec("c = a + b", global_dict, local_dict)
print(local_dict['c'])  # Output: 3

Executing multi‑line code:

multi_line_code = """
 def greet(name):
     return f'Hello, {name}!'
 result = greet('Alice')
"""
exec(multi_line_code)
print(result)  # Raises error because result is not defined outside exec
# Correct approach:
exec(multi_line_code, globals())
print(greet('Alice'))  # Output: Hello, Alice!

Executing a compiled code object:

compiled_code = compile("x = 42", "", "exec")
exec(compiled_code)
print(x)  # Output: 42

Precautions

Security : exec() can run arbitrary code; using it with untrusted input can lead to severe security vulnerabilities.

Performance : Frequent use may degrade performance due to repeated parsing and interpretation.

Debugging : Code executed via exec() is not present in the original source file, making debugging harder.

Scope Management : Properly manage global and local namespaces to avoid accidental overwrites.

Alternatives : Often safer and more efficient alternatives exist, such as functional programming techniques, classes, or configuration files.

Best Practices

Use exec() only when dynamic code execution is truly necessary (e.g., interpreters, DSLs, plugin systems).

Restrict the execution environment by limiting the provided globals and locals.

Validate and sanitize any external input before passing it to exec().