(cherry picked from commit a910a743)

Thanks go to Eugene Ilyin:
http://drupal.org/node/1429208#comment-5561768.

Although not very likely that a user with permissions to set the
widget ID would abuse it for XSS attacks there is really no reason to
not protect it.

Test cases is heavily based on the test cases from Google Analytics
module.

Should have been part of commit
6db43b1e.

Use php_eval() instead if php.module is enabled.