Can anybody externally include my php file in their scripts? E.g. I have a file with classes executing code to db, and is it possible that somebody from external environment includes my php file and is able to run the classes.
closed as unclear what you're asking by RoraΖ, Stephane, user45139, ThoriumBR, Xander Sep 8 '15 at 16:27
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Your PHP files contain scripts that is run on the server side only.
A scenario in which someone could run your PHP scripts on your behalf means either your web application/server is compromised or you have given specific permissions to a trusted third party for that to happen.
This might be possible if you allow read-related directory traversal - an attacker might be able to traverse your file system and find the include file. If he controls your server, then he could drop some PHP code with that include file.
Optionally - remote file inclusion is a variation on the exploit of file-inclusion vulnerabilities by specifying a URL and not a file path. Attacker would need to control your server, find out the name of the include file and upload a PHP script using a FTP service (assuming he discovered or cracked the FTP user password).
For this reason, we do not run FTP services, since FTP passes credentials in plain text, people often leave anonymous FTP open, often use simple passwords etc....