Fix directory traversal and SQL injection

Hi mate, 

just a quick fix for 2 vulnerabilities. The PHP function basename will extract a filename from a path and will prevent people from doing ../../../etc/passwd for example. You may want to tweak the code if you need people to be able to access files/directory1/file1

The second function mysql_real_escape_string will prevent SQL injection for string (in most cases).

If you need more details, let me know.