its safe if u use file_exists

<?
$page = $_GET['page'];
if(file_exists("$page.php")){
include"$page.php";
} else {
echo"The file is not on this webserver.";
}
?>