  If the execPhp sends the string in the request and the server runs the php code (I'm not familiar with php so I don't know if php can run dynamically generated code) then this is an excellent example of user extensibility. The user can extend the application to do whatever the user wants.  You read the WTF, and you're going to leave a comment, but you don't know if php can run dynamically generated code?  