note 8010 deleted from install.apache by imajes

I agree with the previous post. Security is essential but PHP can be very secure if you setup your machine, your webserver and PHP itself correctly. First the machine: Make sure things like 'passwd' are not a threat from any user except root (should be obvious) and certainly not by the webserver user (also use shadow passwords, so that if the passwd file is readable by normal users but contains no passwords.) Make sure that the webserver user, typically "nobody" cant do any damage from a normal shell account, for the sake of testing assume the webserver is compromised, nobody should still not be able to affect any critical files (r,w or x.) Also obvious, but dont use Telnet, or FTP, or any other clear text utilties, make sure you know exactly what services are running on your machine to limit the potential for exploits. Second the webserver: Run it as a protected user, ie the above 'nobody'. Use the respective webserver setup to protect the document root and DONT put ANY sensitive files anywhere in the doctroot (a great exploit is to simply hit a popular search engine and search for admin files or .dat files or whatever, dont put anything in the docroot you dont want exposed and indexed, and forrget about 'robots.txt' for any security, it may tell legitimate robots where not to look, but it tells those looking to exploit EXACTLY where to look.) Restrict everything and explicity allow what you need. Lastly PHP itself. Use PHP as a module and use safe mode. Also apply the same rules that apply to the webserver docroot, dont put stuff in the safe mod dir that is hazardous. Also make sure your scripts do not allow malicious input (see the CERT advisories for a list of common tags, but basically never allow PHP tags themselves as input or other potentially dangerous tags.) These steps are fairly simple and make for a very secure installation. Security is a tradeoff and while no installation is EVER totally secure, these steps will ensure that most exploit attempts are unsuccessful.