I also suspect you might have a security problem with your index.php page if you just include a PHP file based on user input.
For example, if your index.php page does something like this then you have a problem:
<?
// this is a security problem
include $_GET["page"];
?>