create a mapping from a set of fixed input values (such as numeric IDs) to the actual
filenames or URLs, and reject all other inputs.
For any security checks that are performed on the client side, ensure that these checks
are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass