Questão - segurança PHP

The most effective solution for removing file inclusion vulnerabilities is to prevent users from passing input into the file systems and framework API. If this is not possible, the application can maintain a whitelist of files. These files must contain only characters (a-z) and numbers for file names. Special characters – for example, the colon and slashes found in a URL, like http:// – must not be included.

Tirado daqui