getJsonClientI18n() doesn't check the parameter against something in the database. Therefore, you need to sanitize the values resp. check with preg_match() otherwise, you might have a file traversal vulnerability