`$app` is user provided and therefore this is absolutely unsafe to use, this allows an attacker to execute PHP code on the server.