diff --git a/admin/plugin.php b/admin/plugin.php
index 16de979a5..704c3ad5e 100644
--- a/admin/plugin.php
+++ b/admin/plugin.php
@@ -32,10 +32,16 @@ check_status(ACCESS_ADMINISTRATOR);
 $sections = explode('/', $_GET['section'] );
 for ($i=0; $i<count($sections); $i++)
 {
-  if (empty($sections[$i]) or $sections[$i]=='..')
+  if (empty($sections[$i]))
   {
     unset($sections[$i]);
     $i--;
+    continue;
+  }
+
+  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
+  {
+    die('invalid section token ['.htmlentities($sections[$i]).']');
   }
 }