> where does the code actually execute? what's the code writen in?

On every Ethereum node that verifies it. It's usually written in Solidity and compiled to EVM (Ethereum Virtual Machine) bytecode (so it can also be written in other higher-level languages).

> whats stopping malicious code running?

It's sandboxed and since it's limited to the EVM, there isn't really any "malicious" code that could break out of the EVM AFAIK. Inside the EVM it's probably more of a philosophical question whether any code can actually be considered "malicious".