Fixing a security problem

I have a web page that can has a standard include, but a different include can be introduced with a simple GET from the url. I need to improve that so malicious code can’t be introduced. What is a good way to do this?

Here is the current code;

[code=php]
foreach ( $HTTP_GET_VARS as $key=>$value)
{
//print “$key == $value<BR />n”;
$my_file = $value;
unset ($value);
}

if ($my_file != “”)
{
include (“$my_file”);
}
else
{
include(“news/news.htm”);
}
[/code]

I am thinking about doing a test on $my_file to make sure it is not an external file. It could be as simple as a length check or maybe something else would be better. The way it works now is a url might look like this [url]www.mydomain.com/?file=somefile.txt[/url] When the program sees the new variable value, it will include that file instead of the default one.

My website has been hacked by phishing software purveyors and I think this may be the hole they are using.

Recommendations on a fix?

Also in #PHP _↴