You won't be able to exploit code execution that way. Your code is vulnerable to cross-site scripting (XSS), but not code execution. For that you would need something like eval(), or a more subtle implicit php eval call.
However, you can exploit XSS in the above example by injecting Javascript, try something like <script> alert(1) </script> for your user input and see the popup come up in Javascript. :) An attacker could use this to pass a link with the attacker's javascript to an unsuspecting user, who when opens the link, runs the attackers javascript, potentially giving away anything from the application UI or client-side storages to the attacker. The attacker would then be able to do anything Javascript can do, when run in a user's browser in the application context (ie. running on the application origin).
A lot more info on XSS is here for example.
Update (exploiting code execution)
So you cannot execute PHP from user input this way. To make it vulnerable to code execution (ie. to be able to run PHP from user input) you need to use a variable with user input in something like eval(), like for example <?php eval($search_location) ?> in your example.
Another typical way an application would be vulnerable to this is include($_GET['myinclude']), in which case you could try providing http://some.site.tld/yourscript.php as myinclude and see how it is loaded and run on the application server.
Yet another example to make it run php code would be to use the e modifier to a regular expression with user input, as described here.
There may be many more, but simply printing a variable is "only" XSS, not code execution (fortunately, given how many websites are actually vulnerable to XSS). :)
