php include function

hello

there're some reports of php include function being used to execute commands of server

for example, if a PHP script has something like:
include($myvar);

and you call the php like phpname.php?myvar=http://www...

you'll be including a remote code

so my question is... anyone knows a way to disallow includes of REMOTE files, but still allowing local includes?

thanks

 

 

 

 

Top