Untitled

<?php  include('lib.inc.php');  if (LoggedIn())    {    if (isset($_POST['edit']) && isset($_POST['filename']))      {      $edit = $_POST['edit'];      $filename = $_POST['filename'];      if ($filename == 'home.php' || $filename == 'dvds.php' ||         $filename == 'links.php' || $filename == 'contact.php' ||         $filename == 'theme.php' || $filename == 'admin.php' ||         $filename == 'error.php' || $filename == 'index.php' ||         $filename == 'lib.inc.php' || $filename == 'loginscript' ||         $filename == 'mysql.php' || $filename == 'bookmarks.php')        {        $f = fopen($filename, 'w');        echo($edit);        fputs($f, $edit);        fclose($f);        }      else        {        die('Invalid filename');        }              }              elseif (isset($_GET['filename']))      {      $filename = $_GET['filename'];      if ($filename == 'home.php' || $filename == 'dvds.php' ||         $filename == 'links.php' || $filename == 'contact.php' ||         $filename == 'theme.php' || $filename == 'admin.php' ||         $filename == 'error.php' || $filename == 'index.php' ||         $filename == 'lib.inc.php' || $filename == 'loginscript' ||         $filename == 'mysql.php' || $filename == 'bookmarks.php')        {        $f = fopen($filename, 'r');        $contents = fread($f, filesize($filename));        fclose($f);        echo("              <html>                <head>                  <title>Edit pages</title>                </head>                <body>                  <form action='edit.php' method='post'>                    <textarea name='edit' rows='40' cols='80'>                      $contents                    </textarea>                    <input type='hidden' name='filename' value='$filename' />                    <input type='submit' value='Submit' />                  </form>                  </body>              </html>                        ");        }      }    }  else    {    die('Please login');      }?>