User input include
<p>This is pretty darn safe right? Something I've missed?</p>

<pre><code>$page = sprintf("%s/%s.php", "pages", $_GET['page']);
if (file_exists($page)) {
 include $page;
}
else {
 echo "The page '$page' does not exist =(";
}
</code></pre>

<p>(yes you can use it)</p>
