Though I now have an extra if statement in my code to detect and log this type of 'hacking' attempts in addition to some others, the code was never vulnerable to this in the first place. No file contents are displayed at any time anyway.