Using locals() and format() method for strings: are there any caveats?

Question

Are there any disadvantages, caveats or bad practice warnings about using the following pattern?

def buildString(user, name = \'john\', age=22):
    userId =         


        

Answer 1

If the format string is not user-supplied, this usage is okay.

format is preferred over using the old % for string substitution.
locals is built-in to Python and its behavior will be reliable.

I think locals does exactly what you need.
Just don't modify the dictionary from locals and I would say you have a pretty good solution.

If the format string is user-supplied, you are susceptible to injection attacks of all sorts of badness.