note 10286 added to Filesystem Security

One problem with the PHP security model is that a program that might be secure in one environment isn't in another with only a slightly different configuration. For example, consider the comments above about HTTP_REMOTE_USER; saying that it's not a problem is correct in some environments, but not others. For example, if register_globals is set, a cracker can simply pass HTTP_REMOTE_USER as a GET variable; more generally, the cracker can initialize any variable at all. Moral: a PHP script should never count on the value of any environment or HTTP_* variable. A fortiori, a problem with the PHP security model is that it depends so critically on seemingly small config changes. http://www.php.net/manual/security.filesystem.php