safely include files php

safely include files.php

<?php 

#########################################
# Script: Safely include files
#########################################
#
# Security measures: 
# 1. First, use a regular expression to check if $seite contains anything but alphanumeric characters andunderscores
# 2. Check if the file exists before including
# 3. Include the file
#
#########################################




if ( isset( $_GET['seite'] ) ) {

  // 1. Check for allowed Characters 
  if(!preg_match("^[a-zA-Z0-9_]*$", $_GET['seite'])) {
    die("page id must be alphanumeric!");
  }

  $page = $_SERVER['DOCUMENT_ROOT'] . '/' . $_GET['seite'] . '.php';
  
  // 2. check if file exists before including
  if ( is_file( $page ) )
    // 3. include the page
    include $page;
  else
    echo 'That page doesn\'t exist.';
}

?>