(cherry picked from commit 63865a85)

(cherry picked from commit 7017167f)

(cherry picked from commit 9472ffc3)

(cherry picked from commit c2258b5c)

(cherry picked from commit c0c29c34)

(cherry picked from commit 5bd794f4)

Thanks go to Eugene Ilyin:
http://drupal.org/node/1429208#comment-5561768.

Although not very likely that a user with permissions to set the
widget ID would abuse it for XSS attacks there is really no reason to
not protect it.

Test cases is heavily based on the test cases from Google Analytics
module.

Should have been part of commit
6db43b1e.

Use php_eval() instead if php.module is enabled.