Have I built the Allowed class correctly?

Question

PHP

There is a "class" Allowed that compares the keys of arrays ( 1 - an existing array (allowed fields) and 2 - an array that came (POST request))
here is its brief implementation:

$one = array('one','two','three'); //существующий массив эти поля разрешены
$arr = array('one'=>1,'two'=>2,'three'=>3,'four'=>4); //пришел POST
$two = array_keys($arr); // заберу ключи у массива который пришел
$three = array_intersect($one,$two); // Сравню массивы
$out = array(); // сюда запишем совпадения

foreach($arr as $key => $value){
  if(in_array($key, $three)){
    $out[$key] = $value;
  }
}

It will return only those elements of the array whose keys match the existing one ...
Is the implementation correct, it seems to me that I missed something, and everything can be done much easier.
The "class" is there to prevent xss etc.