escaping get parameter in user.php
escaping get parameter in upload.php