I have a basic security question about Magento 2.1
Do any of the modules in a default installation allow the execution of arbitrary PHP code directly from a database field? I'm assuming not, but I need to check.
No. This would be a major security flaw that I cannot imagine would make it through code review at Magento.
To confirm, search for usages of the
eval PHP function in the code base: no results.