A brief discussion on the trade-off between security and performance of php open_basedir

Website security and performance seem to be in conflict with each other. For a php website, it is especially difficult to choose. To give the simplest example: the open_basedir of the PHP configuration file limits the files that PHP can open to the specified directory tree, including the file itself. Originally this is very beneficial to the security of the website; but according to the information obtained by the author from the Internet, open_basedir will have a great impact on the performance of PHP's io operation. Research data shows that the execution speed of script io configured with php_basedir will be 10 times or more slower than that without configuration!

At first, I didn’t quite believe this result, but the test data convinced me to admit this point of view.

Create a simple script:

<?php
functionmicrotime_float()
{
    list($usec,$sec) =explode(" ", microtime());
    return((float)$usec+ (float)$sec);
}
 
$time_start= microtime_float();
 
is_file(&#39;1.html&#39;); //判断当前目录是否有1.html这个文件
$time_end= microtime_float();
$time=$time_end-$time_start;
 
echo"Did is_file in $time seconds\n";
?>

For the test results of open_basedir
0.0006 / 5.0E-5
The gap is quite large, but smart friends should note that the author's website is configured with open_basedir, which has such performance. In terms of loss, I would rather sacrifice performance in exchange for safety. What is your choice? No need to guess, you may make the same choice as me ~ After all, server security is more important.

Tips: How to configure open_basedir
When a script attempts to open a file with e.g. fopen() or gzopen(), the location of the file will be checked. PHP will refuse to open a file when it is outside the specified directory tree. All symbolic links are resolved, so it is not possible to circumvent this restriction via symbolic links.

Special value . Specifies that the script's working directory will be used as the base directory. But this is somewhat dangerous, because the script's working directory can be easily changed by chdir().

In the httpd.conf file, open_basedir can be turned off like any other configuration option using the "php_admin_value open_basedir none" method (such as in some virtual hosts).

In Windows, separate directories with semicolons. Use colons to separate directories on any other system. As an Apache module, the open_basedir path in the parent directory is automatically inherited.

The restrictions specified with open_basedir are actually prefixes, not directory names. This means that "open_basedir = /dir/incl" will also allow access to "/dir/include" and "/dir/incls" if they exist. If you want to restrict access to only the specified directory, end the pathname with a slash. For example: "open_basedir = /dir/incl/".