Do I need to filter data file_exists(), file_get_contents()?

Question

PHP

there is a diagram like this:

$file = (isset($_GET['file']) && !empty($_GET['file']) ? $_GET['file'] : false);
if ($file) {
   if (file_exists($file)) $file = file_get_contents($file);
}

while the get parameter is sent by the client, is it necessary to somehow filter the incoming data in this case? are errors possible?

Answer 1

Of course, this is a classic mistake - you are actually letting the user read an arbitrary file on your server. This is a huge security hole.
Stepic.org has a course on web project security and it has a chapter on exactly this issue.

Answer 2

Some information can be found here