It is recommended that untrusted data is never used to form a file
location to be included.

To validate data, the application should
ensure that the supplied value for a file is permitted. This can be
achieved by performing whitelisting on the parameter value, by
matching it against a list of permitted files. If the supplied value
does not match any value in the whitelist, then the server should
redirect to a standard error page.

In some scenarios, where dynamic
content is being requested, it may not be possible to perform
validation against a list of trusted resources, therefore the list
must also become dynamic (updated as the files change), or perform
filtering to remove extraneous user input (such as semicolons, periods
etc.) and only permit `a-z0-9`.

It is also advised that sensitive
files are not stored within the web root and that the user permissions
enforced by the directory are correct.