For a start a hacker would not actually see the variables if they accessed the file because it would be parsed by php. Make sure that include files have the [FONT=courier new].php[/FONT]extension rather than [FONT=courier new].inc[/FONT].
Also you can use a constant, at the top of each include file you do this:
<?php
if(!defined('VALID')) {
die('Unlucky you scum of the earth hacker... lol');
}
...
?>
Then in the file in which the files will be included you put this code:
<?php
define('VALID', true);
include('include.php');
...
?>
This method ensures that the include files can only be included from the places you want them to be. You may notice this method from the phpBB source code.
