I’ve been working on <a href="https://github.com/Cockpit-HQ/Cockpit" target="_blank" rel="noopener nofollow">Cockpit</a>, a headless CMS, for a while now. One thing that kept coming up was the need for user-defined logic — computed fields, validation rules, content transformations, stuff like that. The kind of thing where you want your CMS users to write small snippets of logic without giving them the keys to the entire PHP runtime.
I looked at existing options. V8js is heavy and a pain to deploy. Lua doesn’t feel right for a web-focused CMS where most users already know JavaScript. Expression languages are too limited once you need a loop or a callback. So I started building my own.
What began as a simple expression evaluator for Cockpit turned into a full ECMAScript subset interpreter: <a href="https://github.com/aheinze/ScriptLite" target="_blank" rel="noopener nofollow">ScriptLite</a>.
<h3>What it does</h3>
It runs JavaScript (ES5/ES6 subset) inside PHP. No filesystem access, no network, no <code>eval</code>, no <code>require</code> — scripts can only touch the data you explicitly pass in. Think of it as a sandbox where users write logic and you control exactly what they can see and do.
<pre><code>$engine = new ScriptLite\Engine();

// User-defined pricing rule stored in your database
$rule = &#x27;
 let total = items.reduce((sum, item) =&gt; sum + item.price * item.qty, 0);
 if (total &gt; 100) total *= (1 - discount);
 Math.round(total * 100) / 100;
&#x27;;

$result = $engine-&gt;eval($rule, [
 &#x27;items&#x27; =&gt; [
 [&#x27;price&#x27; =&gt; 29.99, &#x27;qty&#x27; =&gt; 2],
 [&#x27;price&#x27; =&gt; 49.99, &#x27;qty&#x27; =&gt; 1],
 ],
 &#x27;discount&#x27; =&gt; 0.1,
]);
// $result === 98.97
</code></pre>
It supports the stuff people actually use day to day: arrow functions, destructuring, template literals, spread/rest, array methods (<code>map</code>, <code>filter</code>, <code>reduce</code>, …), object methods, regex, try/catch, <code>Math</code>, <code>JSON</code>, <code>Date</code>, and more.
<h3>PHP interop</h3>
You can pass in PHP objects directly. Scripts can read properties, call methods, and mutations flow back to your PHP side:
<pre><code>$order = new Order(id: 42, status: &#x27;pending&#x27;);

$engine-&gt;eval(&#x27;
 if (order.total() &gt; 500) {
 order.applyDiscount(10);
 order.setStatus(&quot;vip&quot;);
 }
&#x27;, [&#x27;order&#x27; =&gt; $order]);

// $order-&gt;status is now &quot;vip&quot;
</code></pre>
You can also pass PHP closures as callable functions, so you control exactly what capabilities the script has:
<pre><code>$engine-&gt;eval(&#x27;
 let users = fetchUsers();
 let active = users.filter(u =&gt; u.lastLogin &gt; cutoff);
 active.map(u =&gt; u.email);
&#x27;, [
 &#x27;fetchUsers&#x27; =&gt; fn() =&gt; $userRepository-&gt;findAll(),
 &#x27;cutoff&#x27; =&gt; strtotime(&#x27;-30 days&#x27;),
]);
</code></pre>
<h3>Three execution backends</h3>
This is the part that got a bit out of hand. I ended up building three backends:
<ol>
<li>
Bytecode VM — compiles to bytecode, runs on a stack-based VM in pure PHP. Works everywhere, no dependencies.
</li>
<li>
PHP transpiler — translates the JavaScript to PHP source code that OPcache/JIT can optimize. About 40x faster than the VM. Good for hot paths.
</li>
<li>
C extension — a native bytecode VM with computed-goto dispatch. About 180x faster than the PHP VM. Because at some point I thought “how fast can this actually go” and couldn’t stop.
</li>
</ol>
The nice thing is that the API is the same regardless of backend. The engine picks the fastest available one automatically:
<pre><code>$engine = new Engine(); // uses C ext if loaded, else PHP VM
$engine = new Engine(false); // force pure PHP

// Same code, same results, different speed
$result = $engine-&gt;eval(&#x27;items.filter(x =&gt; x &gt; 3)&#x27;, [&#x27;items&#x27; =&gt; [1, 2, 3, 4, 5]]);
</code></pre>
The transpiler path is interesting if you want near-native speed without a C extension:
<pre><code>// Transpile once, run many times with different data
$callback = $engine-&gt;getTranspiledCallback($script, [&#x27;data&#x27;, &#x27;config&#x27;]);
$result = $callback([&#x27;data&#x27; =&gt; $batch1, &#x27;config&#x27; =&gt; $cfg]);
$result = $callback([&#x27;data&#x27; =&gt; $batch2, &#x27;config&#x27; =&gt; $cfg]);
</code></pre>
<h3>Possible use cases</h3>
<ul>
<li>User-defined formulas — let users write <code>price quantity (1 - discount)</code> in a CMS, form builder, or spreadsheet-like app</li>
<li>Validation rules — store rules like <code>value.length &gt; 0 &amp;&amp; value.length &lt;= 280</code> in your database and evaluate them at runtime</li>
<li>Computed fields — derive a field’s value from other fields using a JS expression</li>
<li>Content transformation — map, filter, reshape API payloads or database rows with user-supplied logic</li>
<li>Workflow / automation rules — evaluate conditions and trigger actions defined by end users</li>
<li>Feature flags &amp; A/B rules — express targeting logic as scripts instead of hardcoded PHP</li>
<li>Conditional UI — show/hide elements based on expressions like <code>status === &quot;draft&quot; &amp;&amp; role === &quot;editor&quot;</code></li>
</ul>
It’s a standalone library with no framework dependency. <code>composer require aheinze/scriptlite</code> and you’re good.
<h3>Some numbers</h3>
Benchmarked on PHP 8.4 with 10 different workloads (fibonacci, quicksort, sieve, closures, tree traversal, matrix math, etc.):
| Backend | Total time | vs PHP VM |
|—|—|—|
| PHP VM | 2608 ms | 1x |
| Transpiler | 66 ms | 40x faster |
| C Extension | 14.6 ms | 178x faster |
The transpiler gets within 3-4x of native PHP, which is honestly good enough for most use cases. The C extension is there for when you want to go full send.
<h3>Install</h3>
<pre><code>composer require aheinze/scriptlite
</code></pre>
For the C extension:
<pre><code>pie install aheinze/scriptlite-ext
</code></pre>
Repo: <a href="https://github.com/aheinze/ScriptLite" target="_blank" rel="noopener nofollow">https://github.com/aheinze/ScriptLite</a>
909 tests across all backends. MIT licensed. PHP 8.3+.
Would love to hear what you think, especially if you’ve run into similar “I need users to write logic but not PHP” situations. What did you end up doing?

ScriptLite — a sandboxed ECMAScript subset interpreter for PHP (with optional C extension