PHP Security Configuration

One, Web server security
PHP is nothing but a Web server module function, so first of all to ensure the security of the Web server. Of course, the Web server to be secure and must first ensure that the system security, so it is far, endless. PHP can be combined with a variety of Web servers, and only Apache is discussed here. It is highly recommended that you start Apache in a chroot way, so that even if the Apache and PHP and its scripts are compromised, it is only the imprisoned system that is affected and does not compromise the actual system. However, the use of Chroot Apache, the application will also bring some trouble, such as the connection to MySQL must use the 127.0.0.1 address using a TCP connection and can not use the localhost socket connection, which will be a little less efficient. There is also the mail function to send mail is also a problem, because in the php.ini:
[Mail Function]
; For Win32.
SMTP = localhost
; For Win32.
Sendmail_from = me@localhost.com
are aimed at the Win32 platform, so need to adjust the chroot environment good sendmail.