This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
(bad code)
$userName = $_POST["user"];
$command = 'ls -l /home/' . $userName;