This is just a simple text file, sitting here on my server. It doesn't get executed here - the server just serves you exactly what you see. As you can see, the PHP tags are not processed at my server. However, if you do an include() of this script, IT WILL RUN AS PHP ON __YOUR__ server. Voila, arbitrary code execution. To reiterate: include() does something COMPLETELY different than file_get_contents(). RTFM, people!