Let's say that your form field is called "code" and you're using POST:
$str = $_POST['code'];
print eval($str);
But yeah, it does leave a huge security hole. The user could enter this into the field:
<? print file("/etc/passwd"); ?>
and he might be able to look at the password file on your Linux server...(or he might get errors)... but still, it is bad practice to let the user execute ANY code.
Diego