http://blog.darkhax.com/2010/08/11/most-dangerous-programming-errors-10-6

archive.rb

system("tar cf - #{user.archive_folder} | 7za a -si -mx=#{params[:compression_level]} #{user.temp_archive_name}")

# Go on to serve file...

better_archive.rb

if system('tar', 'cf', user.temp_archive_name(1), 'hacker_folder')
  system('7za', 'a', "-mx=#{params[:compression_level]}", user.temp_archive_name(1), user.temp_archive_name(2))
end

# Go on to serve file...

pain.rb

params[:compression_level] # => "9; rm -rf /;"

# OH THE HUMANITY! Now you get this
system("tar cf - hacker_folder | 7za a -si -mx=9; rm -rf /; hacker_folder.tmp")

show_info.pl

my $dataPath = "/users/cwe/profiles";
my $username = param("user");
my $profilePath = $dataPath . "/" . $username;

open(my $fh, "<$profilePath") || ExitError("profile read error: $profilePath");
print "<ul>\n";
while (<$fh>) {
  print "<li>$_</li>\n";
}
print "</ul>\n";