Restrict PHP access to root folders?

Question

Im making sort of a service where people can upload PHP files and they get their own directory.

Is there a way to prevent any way the PHP can access the root of the server? and just stay in the bounderies of its folder?

Beware of a common vulnerability in this sort of feature: make sure that the files users upload cannot be executed. Especially if they upload, say, a `.php` file. — Frank Farmer, Feb 18 '10 at 18:32

score 1 · Accepted Answer · answered Feb 18 '10 at 18:20

1

The open_basedir directive does just that :

Limit the files that can be opened by PHP to the specified directory-tree, including the file itself.

answered Feb 18 '10 at 18:20

Pascal MARTIN

score 0 · Answer 2 · answered Feb 18 '10 at 18:20

0

The most secure would be to chroot Apache and PHP.

answered Feb 18 '10 at 18:20

Brock Batsell

2 Answers2