$var only exists in a deprecated register_globals environment. That said, NEVER include directly off of a url request without checking if it exists and is what you want.
PHP Code:
<?php
if (isset($_GET['var']))
{
$sFile = basename($var) . '.txt';
include $sFile;
}
You should add additional rules as well. Jail it to a specific directory, do not allow relative paths (basename will only take the filename anyway), etc.