Embed python/dsl for scripting in an PHP web application

Question

I'm developing an web based application written in PHP5, which basically is an UI on top of a database. To give users a more flexible tool I want to embed a scripting language, so they can do more complex things like fire SQL queries, do loops and store data in variables and so on. In my business domain Python is widely used for scripting, but I'm also thinking of making a simple Domain Specific Language. The script has to wrap my existing PHP classes.

I'm seeking advise on how to approach this development task?

Update: I'll try scripting in the database using PLPGSQL in PostgreSQL. This will do for now, but I can't use my PHP classes this way. Lua approach is appealing and seems what is what I want (besides its not Python).

Answer 1

How about doing the scripting on the client. That will ensure maximum security and also save server resources.

In other words Javascript would be your scripting platform. What you do is expose the functionality of your backend as javascript functions. Depending on how your app is currently written that might require backend work or not.

Oh and by the way you are not limited to javascript for the actual language. Google "compile to javascript" and first hit should be a list of languages you can use.

Answer 2

If you are not bound to python, you could use for example Lua as scripting language. Lua is a very lightweight language, easy to learn, and developed with embedding in mind. There are already at least two PHP extensions available, which nicely embed Lua into PHP and therefore provide the possibility to allow access between PHP and Lua part of your application. Have a look at:

http://pecl.php.net/package/lua

This one also has some nice examples:

http://phplua.3uu.de/

I've already used the latter one a bit for simple experiments and it works quite good.

Answer 3

Security, security, security! Just wanted to get that out of the way. What you seem to be trying to do sounds pretty scary but it is your foot to shoot.

Also, what you seem to be trying to do is mix two different server-side languages unless there is an implementation of Python that runs on top of PHP that I am not aware of (PHPython?).

If you are willing to have your PHP code invoke Python in some way, you should be able to do this pretty easily with something like eval() or exec(). See how to input python code in run time and execute it?

As for wrapping your PHP classes, I'm not sure you can accomplish that exactly. You could mirror your PHP classes with Python classes and use something like JSON to transport the data between the two.

Answer 4

I don't know any prefab solutions. But pypy, a Python implementation written in RPython, has a sandboxing feature, which enables you to run the untrusted code.

But if some obvious DSL can be designed for your domain, that might be the easier solution.