psalm/docs/running_psalm/issues/TaintedInclude.md

TaintedInclude

Emitted when user-controlled input can be passed into to an include or require expression.

Passing untrusted user input to include calls is dangerous, as it can allow an attacker to execute arbitrary scripts on your server.

<?php

$name = $_GET["name"];

includeCode($name);

function includeCode(string $name) : void {
    include($name . '.php');
}