Also dunking a URL parameter straight into `open()` looks an awful lot like an injection hole. :)