###JavaScript, 135 chars

function c(p){q='function c(p){q=%27Q%27;p!=unescape(q).replace(/Q/,q)?eval(p):alert()}';p!=unescape(q).replace(/Q/,q)?eval(p):alert()} 

Peter Olson's JavaScript solution inspired me to try porting my Perl solution to JS. Like his solution, this code defines a function c that accepts a string, and evals it if it's not equal to the code above.

It took me a while to figure out a good way to deal with the absence of balanced string delimiters in JavaScript, until I found what in hindsight is the obvious solution: unescape().

Conveniently, my code doesn't contain any backslashes or double quotes, so it can be safely stored in a double quoted strings. This makes it easy to test:

e = "function c(p){q='function c(p){q=%27Q%27;p!=unescape(q).replace(/Q/,q)?eval(p):alert()}';p!=unescape(q).replace(/Q/,q)?eval(p):alert()}" h = "alert('Hello, world!')" eval(e) // defines the function c() c(h) // evaluates h c(e) // does not evaluate e, alerts "undefined" instead 

JavaScript, 135 chars

function c(p){q='function c(p){q=%27Q%27;p!=unescape(q).replace(/Q/,q)?eval(p):alert()}';p!=unescape(q).replace(/Q/,q)?eval(p):alert()} 

Peter Olson's JavaScript solution inspired me to try porting my Perl solution to JS. Like his solution, this code defines a function c that accepts a string, and evals it if it's not equal to the code above.

It took me a while to figure out a good way to deal with the absence of balanced string delimiters in JavaScript, until I found what in hindsight is the obvious solution: unescape().

Conveniently, my code doesn't contain any backslashes or double quotes, so it can be safely stored in a double quoted strings. This makes it easy to test:

e = "function c(p){q='function c(p){q=%27Q%27;p!=unescape(q).replace(/Q/,q)?eval(p):alert()}';p!=unescape(q).replace(/Q/,q)?eval(p):alert()}" h = "alert('Hello, world!')" eval(e) // defines the function c() c(h) // evaluates h c(e) // does not evaluate e, alerts "undefined" instead