I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why?
I found a ...
Local/Remote File Inclusion is a serious vulnerability. Best practice to protect against it is to set in php.ini:
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/html