wikimedia/luasandbox

LuaSandbox is an extension for running untrusted Lua code within a PHP web request. Code is run in a stripped-down, safe environment. Time and memory limits can be set.

4.1.4 2026-07-30 02:16 UTC

MIT

• Tim Starling
• Brad Jorsch
• Kunal Mehta
• Wikimedia Community

Published on Packagist.org on 2026-07-30 02:26 UTC

Extension name: ext-luasandbox

Supports Zend Thread Safety (ZTS): ✅

Supports non-Thread Safe mode (NTS): ✅

Supported operating systems: no restrictions

README

LuaSandbox is an extension for PHP 7 and PHP 8 to allow safely running untrusted Lua code from within PHP, which will generally be faster than shelling out to a Lua binary and using inter-process communication.

This extension has documentation in three different formats. When updating the documentation in one place, remember to update the others as well.

On-wiki documentation

Installation of the extension and some examples are documented on mediawiki.org.

PHPdoc style documentation

PHP interface documentation is provided via stub class definitions in the stubs/ directory. These stubs may be used with IDEs that understand PHPdoc documentation.

These stubs, along with a brief introduction in README.md, may be used to generate online documentation using Doxygen. It should suffice to run doxygen with no arguments.

PHP DocBook documentation

Documentation in DocBook format is included in the LuaSandbox chapter in the PHP manual.

To update this manual chapter, submit a pull request to https://github.com/php/doc-en