This has some pitfalls.
- it will only work if the module name already exist! Either by preloading all modules or by having it already used in another already loaded module.
- It relies on the (documented) implementation detail, that module names are actually built like this. Might break later on when we get private modules.
I tend to use Module.concat/1/2 and Module.safe_concat/1/2 here, depending on the level of trust I have in the data source, or an explicit whitelist, if I know all possible values in advance.
Yes. whenever you deal with some kind of stringified data you should verify it. In your case, you also need to convert it. This should happen as close as possible to the stringified data source. The same goes backwards, if you need to stringify it, do it as close to the data drain as possible. The remainder of your application should never have to deal with the stringified form, neither does it need to know it were strings somewhere else…
