In reply to Peter Lancashire.

Thank you, Peter. In general, executing literal code always has code injection risk, this is why software providers empahsize security more and more, and try to seperate boundary of data and code. Beside X command, SAS also provide a lot of functions/routines under 'Special' and "File I/O" category, which may do something bad to system. However, on the other side, business demand is complicated and sometimes users have to find the balance between security and flexibity/extensibility, platform/language provider has to find a balance and try to satisfy users for this logic. In fact, almost all eval() function in different languages have the same risk, even SQL has the famouse SQL Injection, users have the responsibity to ensure data and code are both safe enough, and this logic only be used in quite limited area such as dynamic evaluation. Users must knows the data and code well and adopt this method prudently, adding a token check logic would be good. Here I attached a quick example code:

proc fcmp outlib=work.func.safe;
function checksafe(exp $);
length token $ 40;
index=0;
do until(token=' ');
index=index+1;
token=scan(exp, index);
if lowcase(token) in ("x" "system" ) then return(0);
end;
return(1);
endsub;
quit;
option cmplib=work.func;

Then add "if checksafe(c)=1 then " before the "call execute(...)", we can simply exclude the x command and system function/call routine etc. If an observation contains predefined danger tokens, execution logic is going to be excluded.

data _null_;
set a end=last;
if _n_=1 then call execute("data b; set a;");
if checksafe(c)=1 then
call execute( "if _N_=" || compress(_N_) || " then d=" || trim(c) || "; ");
if last then call execute("run;");
run;