Best way to avoid code injection in PHP

Question

My website was recently attacked by, what seemed to me as, an innocent code:

Answer 1

@pek - That won't work, as your array keys are 0 and 1, not 'home' and 'page'.

This code should do the trick, I believe:

As you've a whitelist, there shouldn't be a need for file_exists() either.