php code injection attack

You can execute arbitrary php commands by passing main.php specially crafted parameters. For example,

main.php?cmd=setquality&var1=1'.phpinfo().'

will result in a "create_funtion()" call that will execute the phpinfo() command.