if ( /\[include]\s*(\S+)\s*\[\/include]/ ) {
   my $path = $1;
   $path = s#.*/(.*)$#$1#;    # delete any ../../ stuff
   print "<!-- #include virtual=\"/secure_path/$path\" -->\n";
# include only from /secure_path 
}