Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to run a script on my shared hosting account, I keep getting an error relating to open_basedir, which I understand would normally be turned off in the php.ini file, which I don't have access to.

Speaking with the host they recommended that I put this line php_flag open_basedir off in my .htaccess file, so it now looks like this:

<Files ~ "^\.(htaccess|htpasswd)$">
deny from all
AuthUserFile /var/www/vhosts/mydomain.co.uk/httpdocs/pri/.htpasswd
AuthGroupFile /dev/null
AuthName "Please enter your ID and password"
AuthType Basic
require valid-user 
order deny,allow

php_flag open_basedir off

But I still cant get the script to run, have I implemented it correctly? Is there a line in the phpinfo() output that I can view to tell if its worked?

share|improve this question

I could be wrong but as far as I've experienced this value you can not be set in the htaccess since its not supported, not every php.ini change can be done via the htaccess for security reasons.

open_basedir should be set in the httpd.conf, php.ini or vhost.conf

Most web hosting providers actually allow you to create your own php.ini in the home folder of your account, in fact I've yet to come across one that doesn't allow this. Basically yes you use a shared php.ini but you can create your own with certain values in your hosting folder, this is not something which they advertise and you need to ask.

Personally I'd get back on to your support at the hosting, after all isn't that what your paying for?

share|improve this answer
@sam - Additionally, it would not be in a host's best interest to allow people to override this, since it could be used to run PHP shells on their servers, and jeopardize the security of others' websites. As far as I know, I don't believe you can change/override this setting using .htaccess files. This would defeat the entire purpose of the setting. – ionFish Mar 28 '13 at 21:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.