Executing literal code without checking it leaves you open to a code injection attack. Use this method only if you trust the source of the data.

Consider what would happen if an attacker provided "0; run; x 'something-bad';" and you had not prevented use of the X statement.

In general mixing code and data in this way will give you not only a security but also a maintenance headache.