Another way would be to create an array of valid page names, and then include based on that:
$pages = array("news", "user", "pm", "register");
if (isset($_GET['page']) && in_array($_GET['page'], $pages)) {
include "includes/" . $_GET['page'] . ".php";
} else {
include "includes/news.php";
}