Works pretty well, nice job ...
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ...

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...