I am assuming you are doing something like this:
<?php
// $view is set via the query_string eg, index.php?view=bob.txt
include($view);
?>
Now, to make sure no one can include files that you dont want accessible:
<?php
// $view is set via the query_string eg, index.php?view=bob.txt
$allowed = array("bob.txt", "jane.txt", "finances.txt");
if(in_array($view, $allowed)) {
include($view);
}
else {
echo "An error has occured. Please press the back button.";
}
?>
--- OR ----
less security, however, much shorter 🙂
<?php
// $view is set via the query_string eg, index.php?view=bob.txt
@include($view) or die("An error has occured");
?>