It looks like you are making a script that takes the path of the desired content from the URL, then sends that content to the client. While there are valid uses for that and it can be done safely, be careful or you will get in
trouble.
The problem with such scripts is that, without additional code to validate the path, they can be easily manipulated to read anything on the server -- overriding the server's built-in security restrictions, things like .htaccess and so forth.
This is just a mandatory security note: it doesn't mean you shouldn't do it, just make sure you do it right.
