To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use
include to include image files into PHP code.
Sometimes though, the avoidance of image
includes may be not possible at all (for whatever reasons, doesn't matter).
In such case I usually pickup the images somewhere in the upload process and convert them to another image format (sometimes im combination with a lossy compression) to hopefully destroy any malicious code possibly contained in the original image.
This works, but I'm not quite satisfied with it. Mainly because of the additional server load such processing produces and possible image quality decreases that sometimes may happen.
Are the any smarter ways or best practices on that?
To clarify: I'm talking about a siutation where the attacker injects PHP code into an image file to get the injected code executed on server side after uploading the image. Forums for example allow users to upload avatars (small image files) for personalisation.