Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Can someone please explain best practice for permissions with PHP.
What case should something be writable, executable, what owner is best, etc. ?

Using an apache server

share|improve this question
1  
Are you talking about the file permissions of the web server (eg: apache)? –  yi_H Jun 27 '11 at 17:07
    
great, thnx for the tip –  Kirk Strobeck Jun 27 '11 at 17:12
    
You need to provide more details, how are you uploading your files? (SSH/SFTP, FTP, controlpanel?, ...) You mentioned ownership, do you have root access to the box? What user is Apache running? If possible, what distro are you using? See also webmasters.stackexchange.com/q/13658/6597 –  Lekensteyn Jul 2 '11 at 8:10
add comment

6 Answers 6

PHP scripts should be editable by the owner, readable by a group the apache user is in, and optionally readable by anyone. They don't need to be executable. Ideally, most of the php scripts should be outside of a web-accessible folder, especially any configuration files. This way even if there is a problem with the apache configuration, your php files will never be exposed to the web. Often you'll just have an index.php page which calls require_once() on a script in the protected directory outside the web-accessible folder. A .htaccess file rewrites all incoming requests so that they go through the index.php, which then uses the router in the protected directory to figure out what to serve.

share|improve this answer
1  
I like this answer but could you expand with some ie. 0777, 755, 655 kind of numbers, I need to know how to actually set the files –  Kirk Strobeck Jul 5 '11 at 16:21
    
@Kirk Strobeck: editable (read/write) by the owner, readable by a group, and readable by anyone = 644 –  Marco Demaio Jul 5 '11 at 17:29
    
as Marco said, permissions go in order of owner, group, anyone, where read is 4, write is 2, execute is 1, and you add them together. So if you want something read only, it would be 4. If you want read and write, it's 6 (4+2), and if you want all permissions, it's 7 (4+2+1). Most php files will have 644 because the owner has to be able to edit it, everyone needs to be able to read it, and nobody needs to execute it (in the strictly unix sense. php is the executable and it's reading the files, parsing them, and doing stuff with them, so unix isn't actually executing them). –  Bob Baddeley Jul 5 '11 at 18:38
    
also, the 0 at the beginning is optional and useless. It's just saying the number is octal, but since permissions never go above 7, it's pointless to specify. –  Bob Baddeley Jul 5 '11 at 18:39
add comment

You may be confusing the roles of PHP and the file system. PHP does not have read, write, or executable permissions. Those are handled by the underlying filesystem (ext4, NTFS, etc).

You can use PHP functions such as is_writable() and is_readable() to determine the permissions of a given file, and chmod() to change them.

share|improve this answer
add comment

Basically most functions / methods attempting to write to a file in PHP should have an idea like this:

function writeSomething( $file )
{
    if ( !is_writable( $file ) )
    {
        // attempt to make it writable
        if ( !chmod($file, 0777) )
        {
            // could not make file writable
            // log the error....
            return false;
        }
    }

    // perform the writing here..
}

Is a good idea to make sure that you can access the file before attempting to do it because it's always better to show the user a custom error like "There was a problem" than showing a classic PHP error like "Unable to write to file..." or something...

Hope I can help!

share|improve this answer
add comment

0655 is the best permission level. There's really no reason for changing your files above this. Of course there may be a folder here or there that requires some write permissions, but for everything else 0655 will work.

As a tip, make sure that all of your files are owned by apache. This can easily get changed if you ftp'd your files onto the server. So make sure you set them to apache for production sites. This will eliminate a lot of permission issues when running such a tight ship.

share|improve this answer
    
umad? 655 = read+write for owner, read+execute for others. Bad Idea(tm) Whether the files are owned by apache or not depends on the purpose of the files. For a static website, it's better that the files are not writable to avoid attacks in case a hole is found in the code. –  Lekensteyn Jul 2 '11 at 8:11
    
Here again: Why should any (PHP-)file be executable? Also - if the files are owned by Apache, you will have problems to change anything via FTP or SVN if you haven't root access. Better to use a user-group, which includes the Apache (on most webspace-accounts i saw it was www-data). –  feeela Jul 5 '11 at 11:09
add comment

Try to use chmod function http://ua2.php.net/manual/en/function.chmod.php

share|improve this answer
1  
This doesn't answer the question. The question was about best practise, not how to change permission. –  paulmorriss Jul 4 '11 at 15:49
add comment

Commonly used permissions for Cpanel are:

  1. Folder permissions: 755
  2. General File permission: 655
  3. Configuration file permissions: 644
share|improve this answer
1  
Why should any (PHP-)file be executable? –  feeela Jul 5 '11 at 11:05
    
@Shreyas: 644 is the general file permissions under hosting with cPanel –  Marco Demaio Jul 5 '11 at 17:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.