It is recommended that untrusted data is never used to form a file
location to be included.

To validate data, the application should ensure that the supplied 
value for a file is permitted. This can be achieved by performing 
whitelisting on the parameter value, by matching it against a list
of permitted files. If the supplied value does not match any value
in the whitelist, then the server should redirect to a standard
error page.

In some scenarios, where dynamic content is being requested, it may
not be possible to perform validation against a list of trusted resources,
therefore the list must also become dynamic (updated as the files change),
or perform filtering to remove extraneous user input (such as semicolons,
periods etc.) and only permit `a-z0-9`.

It is also advised that sensitive files are not stored within the
web root and that the user permissions enforced by the directory
are correct.