And I missed the question.
@bandonrandon’s solution works if you need to have more security and that’s the way I would go.
For example, one of our client needed a way to embed Wistia videos, which are not supported by wistia. In this case I provided them with a field to enter the video ID and then coded what was needed into a function/shortcode type of thing.
I usually do not supply fields like this to people that could put things in there that they shouldn’t and textarea fields usually work for my purposes.
