Sorry this report is bogus.. the only require/include statement that utilizes that variable is line 188: require(phpAds_path.'/libraries/layerstyles/'.$layerstyle.'/layerstyle.inc.php'); The only possibility is local file include, with null byte bug in php interpreter. But local file include is thwarted with a regular expression.