I don't think it is true. With the creation of the new Rich Text fields QuickBase made provisions to automatically convert Text Fields with some HTML allowed into Rich Text to avoid breaking a lot of applications. Moreover there are many different script injection techniques available today of which IOL is only the first one popularized. Hopefully the product will more directly support user supplied JavaScript in the future but I don't think you have anything to worry about.