You will have to prevent the (?{code}) construct from finding its way into your user's input, lest they manage to inject some unsavory tidbit into your system.

That's not more complicated than not typing use re 'eval';. That is, by default, Perl doesn't honour (?{code}) constructs in interpolated code.