@bandonrandon‘s solution works if you need to have more security and that’s the way I would go.
For example, one of our client needed a way to embed Wistia videos, which are not supported by wistia. In this case I provided them with a field to enter the video ID and then coded what was needed into a function/shortcode type of thing.
I usually do not supply fields like this to people that could put things in there that they shouldn’t and textarea fields usually work for my purposes.
Welcome to the Advanced Custom Fields community forum.
Browse through ideas, snippets of code, questions and answers between fellow ACF users