Koenig,
Вот так будет безопасно? (+/-)
<?php
$result = 0;
$operation = ['+', '-', '*', '/'];
$a = filter_input(INPUT_POST, 'a', FILTER_SANITIZE_NUMBER_INT);
$b = filter_input(INPUT_POST, 'b', FILTER_SANITIZE_NUMBER_INT);
$action = filter_input(INPUT_POST, 'action');
if (in_array($action, $operation)) {
$create = create_function('$a, $b', 'return $a '. $action .' $b;');
$result = $create($a, $b);
}
?>
<form method="post">
<input type="text" name="a" />
<input type="text" name="b" /><br />
<?php foreach ($operation as $opt) { ?>
<input type="checkbox" name="action" value="<?php echo $opt; ?>" />
<?php echo $opt; ?><br />
<?php } ?>
<input type="submit" value="Выполнить" />
</form>
<?php echo $result; ?>