Thanks to Behnam and some Ashianeh guy, escape input and make sure file exists before including it.
Why the hell didnt i escape that?