Local & Remote File Inclusion (LFI/RFI)

How one user-controlled string passed to include() turns into file disclosure, log poisoning and full RCE. Every angle: path traversal, PHP wrappers (php://filter, php://input, data://, expect://, phar://), log-poisoning chains (access.log, error.log, /proc/self/environ, session files, mail log), the filter bypasses, RFI vs LFI, real incidents, and per-language defences (PHP/Python/Java/Node/Ruby/.NET).