If your PHP pages include() or require() files that live within the web server document root, for example library files in the same directory as the PHP pages, you must account for the possibility that attackers may call those library files directly. Any program level code in the library files (ie code not part of function definitions) will be directly executable by the caller outside of the scope