Yes, but it's not save. We don't have any control over what the website is sending and we might end up with something like this (or nastier):
```
eval("os.system('ls')")
```