$val = array( 
             '/^[a-zA-Z0-9\- ]+$/', 
             '/^[0-9-]+$/' 
            ); 
$checkedvar = "home"; 
if (isset($_GET["nav"])) { 
  $quotevar = quotemeta($_GET["nav"]); 
  foreach ($val as $k => $v) { 
    if (preg_match($v, $quotevar )) { 
      $checkedvar = $quotevar ; 
      break; 
    } 
  } 
} 

if(stristr($checkedvar, 'http:') or stristr($checkedvar, 'https:') or stristr($checkedvar, 'ftp:') or stristr($checkedvar, 'irc:') or stristr($checkedvar, '.') or preg_match('=/=', $checkedvar)) 
{$checkedvar = "home";} 


$inc_array = array(); 
$inc_dir=opendir ("./"); 
while ($inc = readdir ($inc_dir)) { 
if($inc != "." && $inc != "..") { 
$short_inc = str_replace(".php", "", $inc); 
array_push ($inc_array, $short_inc); 
} 
} 
closedir($inc_dir); 
if (isset($checkedvar) && in_array($checkedvar, $inc_array) && !preg_match('=/=', $checkedvar)) { 

} else { 
include("home.php"); 
} 
?>
<div align="left">
<table border="0" height="774" width="897" cellpadding="0" cellspacing="0" style="border-width:1; border-color:black; border-style:solid;">
        <tr>
            <td width="166" height="768">
                <table border="1" width="164" height="34">
                    <tr>
                        <td width="154" height="28">Navigation</td>
                    </tr>
                    <tr>
                        <td width="154" height="28">></td>
                    </tr>
                </table>
            </td>
            <td width="729" height="768">
                <table border="0" width="734" height="772">
                    <tr>
                        <td width="514" height="766"><?include("./".$checkedvar.".php"); ?></td>
                        <td width="210" height="766">
                            <table border="1" width="183" height="96">
                                <tr>
                                    <td width="173" height="90"><form action="login.php" method="post">
<u>Username:</u>  <input type="text" name="username"><br>
<u>Password:</u>  <input type="password" name="passwort"><p>
<input type="hidden" name="flag" value="1">
<input type="submit" value="login"><p>
</form>