Directory Permissions when managing files in PHP

[ryan_b83]

I am some scripts that allow users to upload images. However in order to make it work i have to change the permissions of the directory to 777, is this not secure? Is there a better way?

Thanks,
Ryan

[mcavic]

You can set the owner of the directory to the user that the Web server is running as: nobody, apache, or httpd. On some systems you have to be root to make that change, so the workaround for that would be to remove the directory, set the parent directory to 777 temporarily, then re-create the images directory using PHP.

It's still not completely secure, because other Web sites on the server would have write access. But it's the best easy way.

[coopster]

A past discussion that may be of interest:

security / performance tradeoff in image uploads [webmasterworld.com]