Why is eval "ls -l $filename" dangerous when filename comes from a user?
eval "ls -l $filename"
filename
eval restricts the string to ls arguments, so extra shell syntax is ignored.
eval
ls
ls -l automatically runs whoami whenever a filename is invalid.
ls -l
whoami
The read command executes every line before assigning it to the variable.
read
eval reparses the constructed string as shell code, so input can introduce additional commands.