Can someone verify ownership of my site by adding a meta tag to the body of my page?

Matt's answer:

Today’s question comes from Mountain View. Matt asks, I’m worried that someone might be able to inject meta tags into the body of my content, so they could add a “verify” meta tag and control my site in Google’s webmaster console. Will that work? Or do you trust meta tags only in the HEAD section? OK, just wanted to make a quick video to explain this. So the idea was some people thought that you could put the verify meta tag for Google Webmaster Tools in the body, just like when you can edit part of a page, maybe on Wikipedia or something like that. And they were worried that if you can control a site in Google’s Webmaster Console by editing the content of the body, then that might open them up to an attack. And so I just wanted to clarify that we only look for the verify meta tag in the HEAD. So it’s not subject to stuff that’s in the body. So that’s something where, if you’re allowing people to edit the HEAD of your document, that’s really unusual. And you probably shouldn’t let that happen anyway. But just to reassure people, in the common case, with domains, it’s not the kind of thing where you need to worry about– a regular person leaving a blog comment or something like that, and then being able to seize control of your domain in our webmaster tools.

by Matt Cutts - Google's Head of Search Quality Team

Original video: