$command = 'ls -l /home/' . $userName;
system($command);
The $userName variable is not checked for malicious input. An attacker could set the $userName variable to an arbitrary OS command such as:
(attack code)