To add to the (fairly dated) discussion, I suggest you log the error as opposed to just screaming "Hacking attempt" pointlessly. Try something like this:

if (isset($_REQUEST['sIncPath']))
die ('Hacking attempt');
error_log("HACKING ATTEMPT. User with the IP of ".$_SERVER["REMOTE_ADDR"]." has attempted to hack us using ".$_SERVER["SCRIPT_FILENAME"]);

This should log the error in Apache's error log. Handy!