ok heres a more secure method
the other one could be exploited by ?x=file%20onload=badstuff> ( nothing serious but just to be sure lets try this one
sorry for the slopiness im new
Code:
<?php
$mov = $_GET['x'];
$mov = strip_tags($mov);
$mov = str_replace(">", "", $mov);
$mov = str_replace(" ", "", $mov);
echo "<center>Add an advertisement here - dont use quotes<br><embed src=$mov.wmv></embed>";
?>