Security, apache virtual host

Hi, I use PHP with Linux/Apache for a while. Since the server I have also hosts another sites (with apache's virtual domain) security is my main concern. I have two (known issues) : - Users can upload their php in their regular FTP accounts and ~user/somescript that can read other files include .incs or any other php, stealling code or db passwords. For this I've read about a php3_engine that we could insert in httpd.conf disabling scripts from being executed. Unfortunately I do not know how to configure it in php4 (per directory or simply disabling all ~user) since it must go in php.ini now. - How to limit what directories the scripts ran in "authorized" directory can do? I.e I do not want the a script located under /foo can access /foo1/password.inc Of course any tips are welcome. regards, RT __________________________________________________ Do You Yahoo!? Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! http://photos.yahoo.com/