Hmmm - any possible security issues here without sanitizing or validating the $_REQUEST['tab']?