I've actually already written a node on this here - Sorry, I just wanted to see how merlyn felt when he could do this :-)

On to your specific questions, in addition to chip's excellent comments, the end solution will come down to how much freedom you really want to give to these plug-ins. Another solution which you may want to look at would be to use Safe to limit allowed operations. This module allows the creation of compartments in which unsafe Perl code can be evaluated with a new namespace and operator mask - The advantage that this offers is that the evaluated code can only do what you want it to do and cannot change variables outside its own scope (unless explicitly shared).

 

perl -e 's&&rob@cowsnet.com.au&&&split/[@.]/&&s&.com.&_&&&print'