am i right in putting php code in the custom data section, ie: $val1 = 'foo; $val2 = 'bar';

will that be removed in future versions, or is that actually planned?

Sorry, are you asking if that is possible or not? As far as I know only html code works. I don't think that php code will work.

i'm saying php code does work, and i'm building a system that takes advantage of that! however, i don't want to continue with this system if you're going to remove allowing php code in the future

Alright...:-) No plans to change that.

We will continue to treat these fields as text. How that text gets treated depends on what the theme does.

So long as there's no way to access the custom data other than via the admin interface or direct db access there shouldn't be a security problem. (Unless the themer makes use of the custom data in such a way - but then that's his problem.)