Is this running public? are you checking $FORM{'TextFile'} before using it? to see if someone is giving you a thescript?TextFile=/etc/passwd as a query for example?
He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.