You are not performing any (or very little) data validation when updating your options or when storing info in the database. All data needs to be sanitized to ensure malicious code isn't entered.

You can reference the Input Validation section of this article: http://codex.wordpress.org/Data_Validation

Also this article: http://codex.wordpress.org/Class_Reference/wpdb#Protect_Queries_Against_SQL_Injection_Attacks

$filename = dirname(__FILE__) . '/dictionary.txt';

If you're writing to that file, you really would want it one folder up (in wp-content itself) as anything in the plugin folder will get overwritten when the plugin gets upgraded.