ShowDoc 3.9.2 and the username field that ends up as PHP

ShowDoc stored a PHP-capable username in a database file under the web root. The advisory, the fix in 3.9.3, and the three measures that break the chain.