Smokey, just some info to pass along, in case you're interested.
You can look into preg_match to clean variables or test them also. Will come in especially handy if you learn regex's or know a little about them already.
www.php.net/preg_match
Code:
So then: page.php?test=filename.mpg would pass
but page.php?test=`cat /etc/passwd`;etc..whatever-movie.mpg would fail.
Code:
if( !preg_match('/^([A-Z0-9\ \-]+)\.mpg$/i',$_GET['test'],$m) ) {
print '<span style="color:red">Test Failed. Not Allowing.</span>';
} else {
print '<span style="color:blue">Passed</span>: '.$m[0];
}