As far as I know the only form of code execution they support is by the URL datatype which carries the same risks as wel already mentioned anyway.