A safe approach would be to require users to use Reverse Polish (or Postfix) Notation. Then you could just split the input on whitespace and pass the list to rpn() of Math::RPN:

#!/usr/bin/perl -T
use strict;
use Math::RPN;
my $string = '5 2 2 3 add pow 2 sub mul 10 div';  # (5*(2**(2+3)-2)) /
+ 10 == 15
my $result = rpn (split /\s+/, $string);
print "result: $result\n";
__END__
result: 15
[download]

Place a link to the wikipedia RPN entry on your web page, a list of Math::RPN's operators, and done :-)

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}