include and URLs

Under PHP, you can use URLs almost interchangeably with filenames. PHP 4 even allowed you to “include” URLs. However, this was a major security issue. The “include” directive accepts PHP code, which meant that external servers were providing PHP code to your script. If that external file were hacked, your site could be hacked as well.

PHP 5 fixes this by allowing us to disable the use of URLs with the “include” and “require” directives, and we have. You should not be including external PHP code into your PHP code.

If you are simply inserting externally-generated HTML or text, use the PHP readfile function function. It still accepts URLs, but it will not execute PHP code.