title: Is RealPath safe?
body: <pre><code>&lt;?php
  if (preg_match('/^[a-z0-9]+$/', $_GET['p'])) {
  $page = realpath('pages/'.$_GET['p'].'.php');
  $tpl = realpath('templates/'.$_GET['p'].'.html');
  if ($page &amp;&amp; $tpl) {
      include $page;
      include $tpl;
  } else {
      include('error.php');
  }
  }
  ?&gt;
  </code></pre>
  
  <p>How safe would you say this is?</p>