Unexpected Security Problem with PHP URL fopen Wrapper
Within PHP programming language, the URL fopen wrapper feature allows using remote URLs in place of local files in filesystem related functions such as fopen(), copy(), include() and require(). For example, the statementinclude("foo.php") includes and evaluates the file foo.php with respect to include_path setting. Using URL fopen wrapper feature, it is then possible to include a file from remote server using HTTP or FTP: include("http://example.com/foo.php").
That feature looks useful, it is now trivial to create PHP scripts which interact with remote resources. However, users unaware with this ‘(mis)feature’ very often unintentionally introduce security problems in their scripts.

