HI
I have benn working with a similiar script and i have solved this security issue doing a 'string replace' to the url:


str_replace('..','',$requested_url);


It works like a charm.

;)