Including file based on user input: Efficiency and Security Currently I'm using this code: 

&lt;?php
/*
Clean, Simple, Minimal.
*/
$pages = array('home', 'login', 'register', 'logout', 'test');
if (isset($_GET['p']))
{
    $page = $_GET['p'];
    if (in_array($page, $pages))
    {
       include('pages/' . $page . '.php');
    }
} 
 else {
    echo 'Hi';
}
?&gt;


I want this to be as secure and efficient as possible, I've seen multiple versions of this. I wasn't sure how to do what i really wanted, I wanted it so that if the requested file .php exists in /pages/ it'll show it, and else throw an error. But last time i did that I was vulnerable to LFI.
Assuming nobody but you can place files in the directory, this will be safe because you are checking the input page against a pre-defined list of page files. Additionally, this code makes the white list dynamic and throws an exception if the page is not found.

As @tim said in the comment, he found this code to be about 5 times slower then yours. So that's good to keep in mind if you ever decide to use this.

Every .php page you put in the pages/ directory will automatically be callable.

if (isset($_GET['p'])) {
    $page  = $_GET['p'] . '.php';
    $pages = array_map('basename', glob('pages/*.php'));

    if (in_array($page, $pages)) {
        include('pages/' . $page);
    } else {
        throw new Exception('Page "' . $page . '" does not exist.');
    }
} else {
    echo 'Hi';
}