Originally Posted by raymor

Tis called concatenation:

<?php echo do_shortcode('[twitter-feed mode="search" term="' . $USERNAME . ']'); ?>

Please tell me the USERNAME variable is populated by code written by someone cluefull. Tell me you're not setting that with code you wrote. It's cool that you're learning PHP. Both Rasmus and Linus know they have no business designing security systems though, so you're about a decade or two of intensive study away from being qualified to do so.