IMHO an easier compromise between elegant eval and security issues is a hash with '%allowed_ops':

  DB<137> %allowed_ops=map { $_=>$_} qw# + - * / #
 => ("+", "+", "-", "-", "*", "*", "/", "/")

  DB<138> $op ="+"
 => "+"

  DB<139> $statement = "4 $allowed_ops{$op} 5";
 => "4 + 5"

  DB<140> print "$statement = ", eval $statement
 => 1
4 + 5 = 9
[download]

you can also explicitly check for exists in the hash to catch errors beforehand and you are free to "invent" new operators.