When using the content editor in Sitecore, we are noticing that if someone is editing an 'open html' field or something similar, the javascript and iframes are getting executed on the content editor page.

This isn't the behavior I would expect within the content editor. Is there a setting or pipeline I can edit to prevent this?

As an example, if I insert alert('foo') into a rich text field. When I load the content editor, I get an alert saying 'foo'.