diff --git a/web/demos/index.php b/web/demos/index.php
index 9deacd6..5b572e1 100644
--- a/web/demos/index.php
+++ b/web/demos/index.php
@@ -11,14 +11,14 @@ foreach ($directory as $folderinfo) {
 }
 
 foreach ($folders as $folder) {
-  $subDirectory = new DirectoryIterator(dirname(__FILE__) . $folder);
+  $subDirectory = new DirectoryIterator(dirname(__FILE__) . '/' . $folder);
   foreach ($subDirectory as $fileinfo) {
     if ($fileinfo->isFile() && $fileinfo->getExtension() == 'html') {
       $files[] = $folder . '/' . $fileinfo->getFilename();
     }
   }
 }
-sort($folder);
+sort($folders);
 sort($files);
 ?>
 
@@ -37,12 +37,15 @@ sort($files);
         <?php
         if (isset($_GET['file'])) {
           $file = $_GET['file'];
-          $filePath = dirname(__FILE__) . '/' . $file;
-          if (file_exists($filePath) && is_readable($filePath)) {
-            if (pathinfo($filePath, PATHINFO_EXTENSION) == 'php') {
-              include $filePath;
+          // Validate file path to prevent directory traversal
+          $realPath = realpath(dirname(__FILE__) . '/' . $file);
+          $basePath = realpath(dirname(__FILE__));
+          
+          if ($realPath && strpos($realPath, $basePath) === 0 && file_exists($realPath) && is_readable($realPath)) {
+            if (pathinfo($realPath, PATHINFO_EXTENSION) == 'php') {
+              include $realPath;
             } else {
-              echo file_get_contents($filePath);
+              echo file_get_contents($realPath);
             }
           } else {
             echo '<p>File not found or not readable.</p>';
diff --git a/web/demoset.php b/web/demoset.php
index f6c0198..edb4e55 100644
--- a/web/demoset.php
+++ b/web/demoset.php
@@ -1,15 +1,15 @@
-<?php require_once("./include/db_info.inc.php"); ?>
+<?php require_once "./include/db_info.inc.php"; ?>
 
 <?php $show_title = "$MSG_DEMO - $OJ_NAME"; ?>
-<?php require("./template/$OJ_TEMPLATE/header.php"); ?>
+<?php require "./template/$OJ_TEMPLATE/header.php"; ?>
 <div class="padding">
 
 
   <div class="container-fluid">
-    <?php require("./demos/index.php"); ?>
+    <?php require "./demos/index.php"; ?>
   </div>
 
 </div>
 
 </div>
-<?php require("./template/$OJ_TEMPLATE/footer.php"); ?>  
\ No newline at end of file
+<?php require  "./template/$OJ_TEMPLATE/footer.php"; ?>  
\ No newline at end of file