сделал так пока :
$bads = array('closed', 'files', $home, 'public_html', 'etc', 'bin', $str.'../', '../', '../../', '../../../', '../files');
if (!empty($_GET['dir'])){
$dir = $_GET['dir'];
foreach ($bads as $key => $value) {
if ($dir == $bads[$key]){
header('Location: index.php?act=manager&dir=../files/closed');
}
}
}else{
$dir = '../files/closed';
}