Admin page select function I am using this script to get the admin pages via this query string ?page= once the admin is logged in.

Just needing a review, opinions

Function:

// GET PAGE FROM QUERY STRING
public function page_select($page) {
    $ext = '.php';
    $file = 'pages/'.$page.$ext;
    if(file_exists($file)) {
        return $file;
    }
    else {
        $file = 'pages/404'.$ext;
        return $file;
    }
}


Index.php

if(isset($_COOKIE["Cckiuas"]) &amp;&amp; isset($_SESSION["loggedin"])) {
    if(isset($_GET['page'])) { $page = trim(htmlentities($_GET['page'])); }
    else { $page = 'dashboard'; }
    include($backend-&gt;get_base_url().INCLUDES."header.php");
    include($backend-&gt;page_select($page));
    include($backend-&gt;get_base_url().INCLUDES."footer.php");
}
Let's start with the critical issues:


You are vulnerable to directory attacks, I can get you to include any file by using the ../ to traverse up the directory structure, revealing details on your system:

example.com/index.php?page=../../../../../../../etc/passwd%00


The %00 represents the null byte character (See Null Byte Injection), which will terminate the string (thus ignoring your .php suffix). If I input that, I got all the users and passwords on the server (assuming the PHP user has read access, which it shouldn't, but most likely has).
The $ext variable is redundant, are you by any chance going to stop using .php extension even though you won't stop using PHP? (Because, you know, the code is PHP)
htmlentities is pointless if you aren't placing the target string in HTML. (And even if you were, htmlspecialchars is probably better)
INCLUDES is magic. Immutable global variables (like constants) are still global!
Consistent spacing and line-breaks - If you started with multiline in functions and control structures, stick with it.