nginx+php use Open_basedir to restrict site directories from cross-station

Open_basedir the correct format:
php_admin_value[open_basedir]=/data/www/:/tmp/

There is no need to restart the nginx or php-fpm service in this way . For security reasons, you should cancel The Write permission for the. user.ini file.
about the. User.inidetailed description of the file:
http://php.net/manual/zh/configuration.file.per-user.php

it is best to disable functions that execute commands while setting open_basedir, such as:
shell_exec (' ls/etc ') still viewing the List of files to/etc directory
shell_exec (' cat/etc/passwd ') can still view the contents of the /etc/passwd file

disable_functions = pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_ wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wexitstatus, pcntl_wtermsig,  Pcntl_wstopsig, pcntl_signal, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror,  pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_ Getpriority, pcntl_setpriority, eval, popen, passthru, exec, system, shell_ Exec, proc_open, proc_get_status, chroot, chgrp, chown, ini_alter, ini_ Restore, dl, pfsockopen, openlog, syslog, readlink, symlink, popepassthru,  stream_socket_server, fsocket, chdir

Potential security risks after Open_basedir

Http://www.2cto.com/os/201103/86213.html

It's all Php_admin_value open_basedir.  

Http://blog.chinaunix.net/uid-20639775-id-154560.html

nginx+php use Open_basedir to restrict site directories from cross-station