The safest way is to use the associative lookup for allowed filenames … anything else would allow them to substitute an URL for the value (or backrefs to system files) … better to have the ‘authorized list’ be in the script, then no funny-business can be done with the parameter 