 <p>The relevant part for you is the following one:</p> <blockquote> <p>You should only grant permission to use the PHP filter to people you trust.</p> </blockquote> <p>There are always risk of exposing a site to possible attacks when writing code, and in fact the Drupal security team's task is to report security holes to the module maintainers to fix them.<br> With the PHP filter, the more immediate risk is that users who use it have access to any database table. It would be easy for somebody to change the user account's password, change the ownership of a node, etc.</p>