Allow PHP in WordPress Pages and security issue

I want to add PHP codes for pages to a big project.

I am going to use http://wordpress.org/plugins/allow-php-in-posts-and-pages/ plugin.

Read 2 comment in this post (http://www.wpbeginner.com/plugins/how-to-allow-php-in-wordpress-posts-and-pages/)

Comment 1 : No, for obvious reasons this would be an invitation to be hacked. Its very simple to create a shortcode instead (with your own plugin) or use something like the “post snippets” plugin instead.

Comment 2: For the love of Christ, don’t execute PHP from the CMS, probably the single worst thing apart from publishing your FTP details as far as security goes.

Is it true?

How I add PHP codes to WordPress pages?