note 35637 added to function.include

I think it's highly insecure that 'include' and 'require' support http:// url's by default. Why would you want to execute arbitrary code from another web page? I have seen many sites where they are exploitable because they do require $page. ".php"; Although this is bad programming, it's still insecure to allow http url's by default. Also, I'd strongly suggest never using http includes unless you control the DNS for the domain of the site you are connecting to. Otherwide the hostname could be changed over to a different page. ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+35637 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+35637&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+35637&report=yes