Can anybody externally include my php file in their scripts? E.g. I have a file with classes executing code to db, and is it possible that somebody from external environment includes my php file and is able to run the classes.
This might be possible if you allow read-related directory traversal - an attacker might be able to traverse your file system and find the include file. If he controls your server, then he could drop some PHP code with that include file.
Optionally - remote file inclusion is a variation on the exploit of file-inclusion vulnerabilities by specifying a URL and not a file path. Attacker would need to control your server, find out the name of the include file and upload a PHP script using a FTP service (assuming he discovered or cracked the FTP user password).
For this reason, we do not run FTP services, since FTP passes credentials in plain text, people often leave anonymous FTP open, often use simple passwords etc....