I would like to emphasize the danger of remote includes. For example:

Suppose, we have a server A with Linux and PHP 4.3.0 or greater installed which has the file index.php with the following code:

This is, of course, not a very good way to program, but i actually found a program doing this.

Then, we hava a server B, also Linux with PHP installed, that has the file list.php with the following code:

If index.php on Server A is called like this: http://server_a/index.php?id=http://server_b/list

then Server B will execute list.php and Server A will include the output of Server B, a list of files.

But here's the trick: if Server B doesn't have PHP installed, it returns the file list.php to Server A, and Server A executes that file. Now we have a file listing of Server A!

I tried this on three different servers, and it allways worked.

This is only an example, but there have been hacks uploading files to servers etc.

So, allways be extremely carefull with remote includes.

(c) http://php.net/manual/en/function.include.php