We're just lucky this hacker didn't find out that you need to go back 21 directory levels to escape out of the username field.

One more and the server would have been toast.

Of course hackers had more patience in my day. Why I remember when...