Is it a good idea to pass around and insert code from user input? What about javascript hacks, for example?