If you "often" find PHP code in the DB, you're taking over for some godawful contractors. The PHP filter is rarely used and is even being deprecated from D8.