Under possible attacks, there are attacks on the php file
themselves. Some php viruses, (injecktor and variations) scan
the visible directory tree for php and/or html files, then
inject code (such as spam-ware to generate fraudulent page hits)
into otherwise harmless and useful .php scripts. One way to
block this is by using open_basedir to restrict the visible file
system directories to directory tree(s) which do NOT contain any
.php scripts. (see doc page "Description of core php.ini
directives" Note under open_basedir to tighten open_basedir
scope from /www/ which would contain .php scripts to /www/tmp/
which would protect any scripts in /www/ from modification.) If
the php.ini is outside the open_basedir tree, than a malware php
script has no way to alter the core web site files, even if it
were succesfully uploaded via ftp or other mechanism. The damage
done by the spam-ware may seem trivial, but as browsers and
virus programs eventually recognize the spam-ware the web site
becomes effectively completely