Onveilig script

Hallo,

Ik kreeg de melding dat onderstaand script gevaarlijk is voor hackers. Wie kan mij helpen waardoor dat zou komen?

<?
if ($message_nr==""){
$message=Array();
if ($handle = @opendir('../messages')) {
while (false !== ($file = @readdir($handle))) {
if ($file != "." && $file != "..") {
$messages[]=$file;
}
}
closedir($handle);
}
if (count($messages)>1) { sort($messages); }
if (count($messages)>0) { $message_nr=$messages[count($messages)-1]+1; } else { $message_nr=1; }

echo "&error=99-".$message_nr;
}

if ($cmd=="getmessage" && ereg("^[0-9]+",$message_nr)) {
$target_file="../messages/".$message_nr;
if (file_exists($target_file)){
$handle = @fopen($target_file,"r");
while (!feof($handle)) {
$buffer = fgets($handle, 4096);
$data_message=$buffer;
}
fclose($handle);

echo "&data_message=".urlencode($data_message);
echo "&message_nr_new=".($message_nr+1);
echo "&error=0";
} else {
echo "&message_nr_new=".$message_nr;
echo "&error=1000"; // file not found
}
} else {
echo "&error=9999";
}
?>