Including a file (is this safe and effective?) I'm not that experienced with PHP and I'm trying to make it so when I load a page, instead of directly browsing to the file, it will be "included" instead.

I have the code finished and it works.  I just wanted to get an opinion of if it's safe (will people be able to exploit it in anyway?) and if I'm going about this the right way.

&lt;?php
error_reporting(0); // I'm not expecting any errors and don't want users to see any.

    $page = strtolower($_GET['page']); // File names will always be lowercase

    if (isset($page))
    {
        $page .= ".php";
        $page = basename($page); // Prevent users from entering a directory path to access other files.


        if ((file_exists($page)) &amp;&amp; ($page != "index.php")) // Check if exists and prevent infinite include loop.
        {
            die(include($page));
        } 
    }

    include("base.php");
?&gt;
As it uses the basename function it should be safe enough.

One note though: I would personally always have a lookup table (PHP "array") for whitelisting files unless there is a very specific reason not to do so. That way I will have full control and the result should be the same for the user - as a side effect it is way way more easy to have shorter names and/or aliases for files later on.