Programming PHP

If you have .htaccess capabilities on your server and Apache is configured to let you
override Options, you can make the change yourself.
For the most secure session variables possible, create your own session store (e.g., in
a database). Details for creating a session store are given in Chapter 7.
Don’t Use Files
Because all scripts running on a machine run as the same user, a file that one script
creates can be read by another, regardless of which user wrote the script.All a script
needs to know to read a file is the name of that file.
There is no way to change this, so the best solution is to not use files.As with session
stores, the most secure place to store data is in a database.
A complex workaround is to run a separate Apache daemon for each user.If you add
a reverse proxy such as Squid in front of the pool of Apache instances, you may be
able to serve 100+ users on a single machine.Few sites do this, however, because the
complexity and cost are much greater than those for the typical situation, where one
Apache daemon can serve web pages for thousands of users.
Safe Mode
Many ISPs have scripts from several users running on one web server.Since all the
users who share such a server run their PHP scripts as the same user, one script can
read another’s data files.Safe mode is an attempt to address this and other problems
caused by shared servers.If you’re not sharing your server with other users that you
don’t trust, you don’t need to worry about safe mode at all.
When enabled through the safe_mode directive in your php.ini file, or on a per-directory
or per-virtual host basis in your httpd.conf file, the following restrictions are
applied to PHP scripts:
• PHP looks at the owner of the running script and pretends * to run as that user.
• Any file operation (through functions such as fopen( ), copy( ), rename( ), move( ),
unlink( ), chmod( ), chown( ), chgrp( ), mkdir( ), file( ), flock( ), rmdir( ), and
dir( )) checks to see if the affected file or directory is owned by the same user as
the PHP script.
• If safe_mode_gid is enabled in your php.ini or httpd.conf file, only the group ID
needs to match.
• include and require are subject to the two previous restrictions, with the exception
of includes and requires of files located in the designated safe_mode_
include_dir in your php.ini or httpd.conf file.
* PHP can’t switch the user ID via a setuid( ) call because that would require the web server to run as root
and on most operating systems it would be impossible to switch back.
292 | Chapter 12: Security
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.