Dude, don´t allow custom JS script. Really, don´t. I could use that to grab cookie´s, to install malware and so much more.
I guess in this case what could be done is a "filler code"... like this:
Let's use your Bitads style for the example...
Alright, what you would do is allow inputting the user's id#, such that your code (pseuducode) would be like this:
$bitid = 37;
echo '
Would that help with safety? You could even set the type of input id could be such that it could only be a number.
.