this attack could have been prevented if the file permissions did not allow viewing the file or if the shell functions of php were disabled so that arbitrary shell commands cannot be executed from php.