Stupid open_basedir handling in PHP

There are several possible solutions to your problem: 1. Use relative paths and set up the systems accordingly. 2.Use a local configuration file that stores the path to the directory. Both options are a better application design than the current solution (I presume you hardcoded all possible paths in your code and then check which one is the right one). Both solutions make sure that the application continues to work even when you install it on another 10 servers with different filesystem layouts. Solution number 2 makes sure you have to edit just one configuration file instead of having to modify the source code.

That's not true. :) Two possibilites: Either "some ppl" are allowed to change the source inside the document root. Then they can already do everything they want with the source. Or they are not allowed to modify the source. Then you just upload the correct configuration file for each webserver and you are set. No need to modify the source code or to check 5 (later 10, 20, ...) different paths to find the right one. If you are afraid people will break stuff by having write access, remove it. If people set incorrect configuration values, they deserve to get an error. And using a config file was just one example - the point was to make it configurable instead of hardcoding it in the application. You may want to store these deployment-dependent settings in a database. Where you store them is not the issue - just don't hardcode deployment-dependent data inside an application.

Yes I know, you like to do that. Still, I do not think this is a PHP problem. It might even be documented that nonexistant paths are removed from the open_basedir setting (I don't know, but it does sound sensible, maybe it is even good for security purposes). The fundamentally wrong thing here is that you have a deployment (server) dependent setting in source code. It doesn't matter if you need it in the environment or how you use it, it should not be hardcoded in PHP source code. And I agree with you, telling people to modify one specific, well documented configuration file is completely different than modifying source code. That's why I would opt for that solution. It can even be a PHP file. I see no reason why that wouldn't work or why that solution would be inferior to just hardcoding the paths. Care to enlighten me?