diff --git a/html/ajax_form.php b/html/ajax_form.php
index 602ad6ee3..9899a0a67 100644
--- a/html/ajax_form.php
+++ b/html/ajax_form.php
@@ -24,9 +24,13 @@ include_once("includes/authenticate.inc.php");
 
 if (!$_SESSION['authenticated']) { echo("unauthenticated"); exit; }
 
-if(file_exists('forms/'.$_POST['type'].'.inc.php'))
-{
-  include_once('forms/'.$_POST['type'].'.inc.php');
+if(preg_match("/^[a-zA-Z0-9\-]+$/", $_POST['type']) == 1) {
+
+  if(file_exists('forms/'.$_POST['type'].'.inc.php'))
+  {
+    include_once('forms/'.$_POST['type'].'.inc.php');
+  }
+
 }
 
 ?>