$var only exists in a deprecated register_globals environment. That said, NEVER include directly off of a url request without checking if it exists and is what you want.
$sFile = basename($var) . '.txt';
You should add additional rules as well. Jail it to a specific directory, do not allow relative paths (basename will only take the filename anyway), etc.