diff --git a/doc/index.php b/doc/index.php
index 329ab31c35a..da7bf50def4 100644
--- a/doc/index.php
+++ b/doc/index.php
@@ -2,9 +2,9 @@
 
     require("../config.php");
 
-    optional_variable($file, "");     // docs file to view
-    optional_variable($frame, "");    // docs file to view
-    optional_variable($sub, "");      // sub-section (named anchor)
+    $file  = optional_param('file', "", PARAM_FILE);  // docs file to view straight
+    $frame = optional_param('frame', "", PARAM_FILE); // docs file to view in frame
+    $sub   = optional_param('sub', "", PARAM_CLEAN);  // sub-section (named anchor)
 
     if ($CFG->forcelogin) {
         require_login();