I've been slowly working on a personnel project to run a webmud like game using extjs as my frontend. One of the design choices I made was to allow user-generated evaluated code for game logic. So when the player enters a new "room" a number of state scripts would be called along the lines of "has player been here before, should they be here, do they have x inventory item" and then respond accordingly. Furthermore basic room "actions" would be hard coded ( go N/S/E/W ) but advanced actions would be available as the same user-generated evaluated scripts.
Originally I was going to be lazy and use evaluated PHP for this logic, but my paranoid sense is kicking in. So the two alternatives I have found is the runkit_sandbox but it doesn't support an interchange of objects between the primary thread and the sandbox ( just simple data types and arrays) OR using ecmascript as my game logic http://ejohn.org/blog/spicing-up-embedded-javascript/.
The pro/cons of the two is that with runkit, I can lock the script down pretty hard at a tremendous cost to speed while the ecma interpreter would allow me to selectively bind variables, functions, and possibly objects to the javascript run space but its still in beta state and I've yet to see how well it runs.
Is these it for options or is there something else out there I don't know about that might be a better choice? Environment: linux, PHP-CGI 5.3 or as a google app engine.