Phpopen_basedir security and performance

Talking about the security and performance of phpopen_basedir, the relationship between website security and performance seems to be the relationship between spear and shield. It is especially difficult for a php website to choose from. For example, open_basedir of the php configuration file limits the files that PHP can open to the specified directory tree, including the file itself. Originally, this is very beneficial to website security. However, according to the information obtained from the Internet, open_basedir will have a great impact on the performance of php io operations. Research data shows that the script I/O execution speed with php_basedir configured is 10 times or more slower than that without php_basedir!

At first, I didn't quite trust this result, but the test data convinced me to admit it.

Create a simple script:

Test results for open_basedir
0.0006/5.0E-5
The gap is quite large, but smart friends should note that the author's website is configured with open_basedir. compared with this performance loss, I would rather sacrifice performance in exchange for security, what is your choice? You don't have to guess. you may be the same as me ~ After all, server security is more important.

Tips: how to configure open_basedir
When a script tries to open a file using fopen () or gzopen (), the file location will be checked. PHP rejects opening a file outside the specified directory tree. All symbolic connections are parsed, so it is impossible to avoid this restriction through symbolic connections.

Special value. indicates that the script's working directory will be used as the reference directory. But this is dangerous because the working directory of the script can be easily changed by chdir.

In the httpd. conf file, open_basedir can be disabled using the "php_admin_value open_basedir none" method like any other configuration options (for example, in some virtual hosts ).

In Windows, separate directories with semicolons. Use colons to separate directories in any other system. As an Apache module, the open_basedir path in the parent directory is automatically inherited.

The restriction specified by open_basedir is actually a prefix, not a directory name. That is to say, "open_basedir =/dir/incl" will also allow access to "/dir/include" and "/dir/incls" if they exist. If you want to restrict access to a specified directory only, end the path with a slash. For example, "open_basedir =/dir/incl /".