Thanks to Behnam and some Ashianeh guy, escape input and make sure file exists before including it.
Why the hell didnt i escape that?
Merge pull request #7 from emilsedgh/master

Security fix.