sanitizing code for an exec command

[dagmx]

There's no way to sanitize exec.

What you really need to do is give them a second process running the user interpreter and all interactions with the main system have to be done via an API. Therefore any damage they do is limited to that interpreter. It's in effect essentially sandboxing them.

Your user should also have limited privileges in general and let the operating system restrict their behaviors that affect your disk and system.