Again and again: php_flag register_globals Off :-)
better if not just via .htaccess - at host level.
second - disable all possible script of flash includes (better any html).
Third, was good solution too:

#RewriteCond %{QUERY_STRING} ^http [OR]
#RewriteCond %{QUERY_STRING} ^.+www\. [OR]
#RewriteCond %{QUERY_STRING} ^.+https [OR]
#RewriteCond %{QUERY_STRING} ^.+ftp
#RewriteRule .* - [L,F]
#RewriteCond %{HTTP_USER_AGENT} ^libwww [OR]
#RewriteCond %{HTTP_USER_AGENT} ^Wget
#RewriteRule see more .* - [F]

#RewriteCond %{QUERY_STRING} (.*)=http(.*) [NC,OR]
#RewriteCond %{QUERY_STRING} (.*)urlx=(.*) [NC]
#RewriteRule ^(.*) - [F]

and even php_value allow_url_fopen 0 :-)