This is how it is executed: $variable = "{${phpinfo()}}"; // <- Execution happens here echo "$variable is fish"; If you pass a "{${phpinfo()}}" via GE

This is how it is executed: $variable = "{${phpinfo()}}"; // <- Execution happens here echo "$variable is fish"; If you pass a "{${phpinfo()}}" via GET, it is not executed. The execution has to happen later - e.g. by eval() or /e.