best proceed prevaricate formula injection php

my website recently pounded by, seemed me as, an trusting code:

<?php
  ( isset( $ _get['page'] ) ) {
    include( $ _get['page'] . ".php" );
  } else {
    include("home.php");
  }
?>

there where sql calls, i wasn't fearful sql injection. but, apparently, sql isn't wholly kind injection.

this website an reason few examples avoiding formula injection:

how strengthen formula code injection?