or it's kind of a schroedinger's PHP. as long as you don't debug it, it simultaneously includes every security hole ever, and none of them.