Interpret text input as PHP

Question

I want to let users test out a PHP class of mine, that among other things crops and resizes images.

I want them to write PHP code in a text field, send the form, and then their code will be run. How can I do this?

Or is it other safe ways to let users (anyone) demo a PHP class?

Answer 1

I would spawn the PHP process using a user account with next-to-no permissions. Give the read-write access to a single directory, but that's it.

You're still opening yourself to DoS attacks with infinite loops and such, but if you absolutely must do it, then run the code in this very-low-permissions sandbox like IE and Chrome do.

Using EVAL is probably the worst idea.