or at the very least limit the input...

Something like

if($exp =~ /^[-+/*%()\s\d]+$/) {
  print eval $exp;
}
[download]

or something along those lines it would make it much harder to actually do anything underhanded.

Exactly what taint mode encourages people to do.