note the $() around it, that is actually the same as $eval(). so when you try to echo it, the code contained in the encrypted string is executed. lesson: dont blindy try to echo every $decode string you see.