Restrict PHP files to respective User folder

[GB_001]

Hi, I was wondering how I would go about stopping PHP files from altering things outside of it's directory.

Say [user X] creates a PHP script that script automatically saves to [user X]'s folder located within Localhost/Users/ where all user folders are located.

But none of [user X's] files can access access any folder above it's own.

 

How would I be able to specify this in PHP or the PHP.ini?

 

Example

 

Things like "$fp=fopen($_SERVER['DOCUMENT_ROOT'] ."/Users");" would be bad.

 

Thankyou,

GB.

[trq]

Take a look at open_basedir, http://www.php.net/manual/en/ini.core.php#ini.open-basedir

 

You might also want to take a look at safemode.

[GB_001]

Take a look at open_basedir, http://www.php.net/manual/en/ini.core.php#ini.open-basedir

 

You might also want to take a look at safemode.

 

So basically I'd have to do something like:

[PATH=/path/to/Users/]

  open_basedir = /path/to/Users/

 

If so, wouldn't the Users be able to possibly access another User's folder?

[trq]

You can set this directive on a per virtual host basis.

[GB_001]

That'd work if I were using virtual hosts, but I'm not as I'm just using a different folder per User where their individual PHP files are kept.

[trq]

Then you don't really have enough control over the configuration. You could set this via a .htaccess, though there would be nothing stopping a user from editing the .htaccess file.

[GB_001]

Then you don't really have enough control over the configuration. You could set this via a .htaccess, though there would be nothing stopping a user from editing the .htaccess file.

 

How would I be able to do it via .htaccess?

Also users would only be able to edit their PHP files via editor I provide them so I don't think they'd be able to edit the .htaccess.