use literal eval for better security