security - PHP: Is it safe to include a file based on a GET variable, if you use preg_replace to only allow the following -A-Za-z0-9_ -

how safe this?

   if (isset($_get["var"]) && file_exists("path/".$_get["var"].".php")) {          include("path/".$_get["var"].".php");     } else {           echo 'file not exist!';        } 

i'm wondering if $_get["var"] needs "sanitized" opposed letting run against file_exists function before trying include or not. dangerous?

+++updated+++

thank responses! please see updated below...

function mrclean($var) { $clean_var = (isset($var) && !empty($var)) ? $var : 'index'; $clean_var = preg_replace('/[^-a-za-z0-9_]/', '', $clean_var); return $clean_var; }  $var = mrclean($_get["var"]);  if (file_exists("path/".$var.".php")) {    include("path/".$var.".php"); } else {     echo 'file not exist!';    } 

when call on mrclean replace all, following:

- a-z a-z 0-9 _ via preg_replace

...will considered safe? there can added make safer?

i implement whitelist suggested... else?

thank you!!

-andrew

yes, regex replace within question update safe. aware of include dangerous , if allow user include unsafe script.