my $mf = $cgi->param('_mf_');
    $mf =~ s/\.\/\\//g; # remove . \ / chars
    $mf ||= "default";