Only "security" is this array of items which are regexed out of whatever you submit (and as you pointed out, completely fail to even prevent those functions from being called.

$replace = array('<?php', '?>', '<?', 'mkdir', 'eval', 'exec', 'copy', 'move', 'curl', 'passthru', 'system', 'popen', 'proc_close', 'proc_open', 'proc_ terminate', 'proc_nice', 'shell', 'dl');