Doing it via ajax isn't terribly complicated, neither is executing perl in a safe way. I've been running a bot that does much the same thing for a while now and a combination of chroot and a bunch of restrictive ulimits have made it extremely safe.
Chroots and ulimits were my solution.
Fork a process, chroot it to someplace useless, add a series of extremely restrictive ulimits for memory, open files, cpu and so forth, then have it drop to a nobody user so it can't change them.
If you're interested in working further on this, send me a private message and we can talk specifics.