Avoid eval on input
Never pass input to eval. Run a command held in an array as "${cmd[@]}", or escape a value with printf %q when eval cannot be avoided.
A script builds a command from a value the user typed and runs it with eval, which runs whatever else the value contains.
user_input='x; echo INJECTED'
eval "echo $user_input"
echo ---
eval "echo $(printf '%q' "$user_input")"
echo ---
cmd=(echo "$user_input")
"${cmd[@]}"x
INJECTED
---
x; echo INJECTED
---
x; echo INJECTEDeval joins its arguments into a string and parses it again as shell code, so the semicolon in the input ends the first command and starts a second one, which printed INJECTED. printf %q quotes the value so that it parses back as one word. An array avoids the second parse altogether, since each element stays one argument, and "${cmd[@]}" runs it. The Bash FAQ covers building commands this way.
%q output is Bash specific and its quoting style can differ between versions, so do not use it for data that another shell reads. Arrays need Bash or another shell with arrays. An indirect variable, ${!name}, or declare -n replaces most uses of eval for variable names, and a name taken from input should be checked against a pattern first.