Added filter

$field = filter_var($_GET['fid'], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);

If attempted xss then $field will be null

Let me know if this breaks anything. It should be good. 

If you could help me out with listing all the files and subfolders in one list... that would be awesome! Thanks! See issue #2.