Creating Directories and Files through PHP and Permissions Issues

Question

I have a php application that creates directories and files from user input. Is it a problem to have php create the directories/files and then use the php chmod function to set the permissions to 755/644?

When I do that, it looks like the only way to delete those files is through php. So if I want to delete them via FTP, it won't work because apache/php owns them.

Mainly, though I'm trying to figure out if I would need to do anything else besides chmod to 755/644 for the directories/files to make things as secure as possible.

Answer 1

Just chmod them to 777 via php. Then youll able to delete files from ftp. 755 still allows writing only for php..

Answer 2

If you use php to create directories and files from user input you should consider disallowing execution of php (and other) scripts from location where it stored. This can be done in .htaccess if you are using apache web-server.

AddType text/html .php .cgi .pl .fcgi .fpl .phtml .shtml .php2 .php3 .php4 .php5 .asp .jsp