> The Redis protocol has no concept of string escaping, so injection is impossible under normal circumstances using a normal client library. The protocol uses prefixed-length strings and is completely binary safe.
Lua scripts executed by the EVAL and EVALSHA commands follow the same rules, and thus those commands are also safe.
While it would be a very strange use case, the application should avoid composing the body of the Lua script using strings obtained from untrusted sources.