This looks dangerous. What if someone will pass: ?lang=../../../php.ini"; we should sanitize the GET parameters.