Yeah, that is exactly why taint protection isn't on.. I know it's dangerous to take the input that way. While the regex keeps all traditional '../' and such attacks from using the script, I decided to keep this one under a passworded folder on the server so it's harder to access.