Usually there is some kind of sandboxing in place. That way you can limit what the code is allowed to execute. For e.g. in PHP you would probably use Runkit[1] for this.

1. http://php.net/manual/en/book.runkit.php