Adding &some_url_parametr=../../../etc/passwd (or ../../../var/uploads/evil_script.txt) allows you to insert arbitrary text file from the server into the generated HTML or execute arbitrary PHP code (which in turn can even run arbitrary shell commands if this is enabled on the server).
Since PHP has such feature, people use it and to this day you'll occasionally run into a website which employs this pattern. Common use case is
bad-example.com/article.php?id=article_name.txt
where article.php contains headers, footers, formatting, etc and actual articles are stored in text files.
Since PHP has such feature, people use it and to this day you'll occasionally run into a website which employs this pattern. Common use case is
where article.php contains headers, footers, formatting, etc and actual articles are stored in text files.