What will happen if a attacker includes his file in your server

Answer

Anything can happen - even attacker can delete all your files and database.

It is very critical security issue.

For example consider an attacker includes the following line in your php file

exec("rm -rf /home ")

If the line executed in the server all the files inside the home directory may be deleted.