directory traversal

[kampar]

I think there is a needs to escape some bad $_GET variables

$zoom = intval($_GET['z']);
$column = intval($_GET['x']);
$row = intval($_GET['y']);
$db = preg_replace("/[^a-z0-9_]/i","",$_GET['db']);

    $conn = new PDO("sqlite:". $db  .".mbtiles");