>> One thing my company has done is written a ``safe_eval()`` that uses >> a regex to disable double-underscore access. Alex> will the regex catch getattr(object, Alex> 'subclasses'.join(['_'*2]*2)...?-) Now he has two problems. ;-) Skip