PHP可以在我的电脑上需要任何PHP文件吗？

can php require any php file in my pc?

I set the apache www root folder to be d:\phpnow\htdocs, I thought that php can only require php files under this folder before ,such as require('laji/hello/a.php');
today I found it php can load any php file in my PC ,only need the full path.
how to prevent ? it should not safe for web server.

can php require any php file in my pc?

Any file that the user whom the PHP program runs as has permission to access. (That is to say, filesystem permissions).

how to prevent?

Limit the permissions on the file system or chroot the server so it runs in a sandboxed environment. (I've no idea if chrooting is possible on Windows)

it should not safe for web server.

It is perfectly safe unless either:

• You allow untrusted users to install their own PHP programs on your PC (but see also What do you recommend for setting up a shared server with php)
• You allow file paths on your filesystem to be selected via unfiltered user input

PHP can include any file on the server within its jailed limits, if any. In this case your computer is the server. It's not a security issue, since a remote server has no way of accessing your file system.

You can deny access to a directory using .htaccess file since you run php with Apache.

If you want to block direct access to the whole includes folder, you can put a .htaccess file (the file has only extension, and no filename. You may use notepad to type code and save it as ".htaccess" with quotes, called absolute naming) in that folder that contains;

deny from all

If you want to disable directory listing, here is a tutorial:

Directory listing in htaccess. Allow, Deny, Disable, Enable Directory Listing in .htaccess

and you may refer this Stack Overflow question .htaccess deny access to folder

Just Google for folder access deny using htaccess and you can find lots of stuff.