Apache+PHP环境下虚拟主机防被旁注
IS环境下比较容易实现，可以通过独立“匿名访问账户”+NTFS权限来防止。
查了一下，Apache下类似IIS的独立虚拟主机账户的方案貌似不太好实现，但有一种更简单的方法：
就是在VirtualHost节中通过添加
php_admin_valueopen_basedir/data/wwwroot/www.xxxxx.com
来限制当前虚拟主机PHP的操作权限仅在/data/wwwroot/www.xxxx.com目录下。
我用Phpspy测试了一下，果然很有效，未加该限制时可以列出文件)。
注意：
因为Web服务器在处理文件上传时会用到系统的临时目录(对于Linux来说就是/tmp)，所以还必须要有这个目录的操作权限才可以。
php_admin_valueopen_basedir支持同时设置多个目录，目录之前要用:分隔。完整如下：
php_admin_valueopen_basedir/data/wwwroot/www.redicecn.com/:/tmp/
来自于PHP官方的更多说明：http://www.php.net/manual/en/ini.core.php#ini.open-basedirwww.chnhack.com
open_basedirstringLimitthefilesthatcanbeopenedbyPHPtothespecifieddirectory-tree,includingthefileitself.ThisdirectiveisNOTaffectedbywhetherSafeModeisturnedOnorOff.
Whenascripttriestoopenafilewith,forexample,fopen()orgzopen(),thelocationofthefileischecked.Whenthefileisoutsidethespecifieddirectory-tree,PHPwillrefusetoopenit.Allsymboliclinksareresolved,soit’snotpossibletoavoidthisrestrictionwithasymlink.Ifthefiledoesn’texistthenthesymlinkcouldn’tberesolvedandthefilenameiscomparedto(aresolved)open_basedir.
Thespecialvalue.indicatesthattheworkingdirectoryofthescriptwillbeusedasthebase-directory.Thisis,however,alittledangerousastheworkingdirectoryofthescriptcaneasilybechangedwithchdir().
Inhttpd.conf,open_basedircanbeturnedoff(e.g.forsomevirtualhosts)thesamewayasanyotherconfigurationdirectivewith“php_admin_valueopen_basedirnone“.
UnderWindows,separatethedirectorieswithasemicolon.Onallothersystems,separatethedirectorieswithacolon.AsanApachemodule,open_basedirpathsfromparentdirectoriesarenowautomaticallyinherited.
Therestrictionspecifiedwithopen_basedirisadirectorynamesincePHP5.2.16and5.3.4.Previousversionsuseditasaprefix.Thismeansthat“open_basedir=/dir/incl”alsoallowedaccessto“/dir/include”and“/dir/incls”iftheyexist.Whenyouwanttorestrictaccesstoonlythespecifieddirectory,endwithaslash.Forexample:open_basedir=/dir/incl/
Thedefaultistoallowallfilestobeopened.
Note:
AsofPHP5.3.0open_basedircanbetightenedatrun-time.Thismeansthatifopen_basedirissetto/www/inphp.iniascriptcantightentheconfigurationto/www/tmp/atrun-timewithini_set().Whenlistingseveraldirectories,youcanusethePATH_SEPARATOR
另外看到了另外一种设置临时目录的方法：http://brandonwamboldt.ca/multiple-directories-w-php-open_basedir-540/
php_admin_valueopen_basedir/var/www/vhosts/saebermedia.com
php_admin_valueupload_tmp_dir/var/www/vhosts/saebermedia.com/.tmp