They don't allow the ones that enable arbitrary PHP execution within pages.