Define a local boolean var for showact to avoid security issues, also pass order parameter trough htmlspecialchars()
Pass path parameter through htmlpecialchars()