Use proper framework

[Atlasfreak]

Use routes so there is not .php in the url and proper control over what can be accessed.

[Atlasfreak]

Or in general a more complete framework like flight