PHP Code to replace a token with injected content

code.php

<?php
class Code
{
  private static $langs = array(
    "gd" => "gdscript",
    "cpp" => "C++"
  );

  public static function insert($content)
  {
    if (!Session::$is_moderator)
    {
      $code = "";
      preg_match_all("/##(\w+\.(\w+))##/", $content, $matches, PREG_SET_ORDER);
      foreach ($matches as $m)
      {
        $fn = dirname(__DIR__) . '/code/' . $m[1];
        if (file_exists($fn))
        {
          $lang = "JavaScript";
          if (array_key_exists($m[2], self::$langs)) $lang = self::$langs[$m[2]];
          $code = '<code class="language-' . $lang . '">' . file_get_contents($fn) . '</code>';
        }
        else
          $code = $fn . " NOT FOUND!";
        $content = str_replace($m[0], $code, $content);
      }
    }
    echo $content;
  }
}

This is the code for a Class that I created for OtakuCMS. In the WYSIWYG content editor, you enter say: ##my-gdscript-code.gd## and the source code (from web-root/code/my-gdscript-code.gd) for that file is injected into the HTML of the web page intended to be syntax highlighted by prism.js

The Session::$is_moderator boolean value is true when the admin user is logged in and likely to be editing the content and hence inserting the tags into the content. When they are logged out, it is like a normal web page visitor where the code gets inserted in place of the tag.