$path = 'includes/'; $extension = '.php'; $default = 'news'; $page = (isset($_GET['page'])) ? $_GET['page'] : $default; $includedFile = $path.'error'.$extension; if(preg_match('#^[a-z0-9_]+$#i',$page)){ $file = $path.$page.$extension; if (is_file($file)){ $includedFile = $file; } } include($includedFile);