This is the most optimal way of dealing with a multilingual website I can think of, right now (not sure) which doesn\'t involve gettext, zend_translate or any php plugin or
The only way that this could be xss is if you have register_globals=On and you don't set $lang['showcase_lil'] or other $lang's. But I don't think you have to worry about this. So I think your in the clear.
as an xss test:
http://127.0.0.1/whatever.php?lang[showcase_lil]=alert(/xss/)