Query parameter not lowercase

HI   i have noticed that the if statement below can be bypassed if the query parameter "biscuit" is altered in the browser to have an uppercase letter (Biscuit):   if {[matchclass [string ...