and is it really a security concern

[tp widget="default/tpw_default.php"]