If you don't, an attacker will be able to craft HTTP requests that execute whatever command they want. Let's see how easy it is.