Imagine you run a simple site that performs DNS lookups. Your site shells out to the nslookup command, then prints the result. Notice how the 'domain' parameter is taken in from the GET request, and immediately interpolated into a command string.