PHP가 아파치 모듈로 사용되면 아파치 사용자 권한을 그대로 이어받는다. (보통 'nobody' user) 이것은 보안과 인증에 대해 각각 영향을 미친다. 예를들어 PHP로 데이타베이스에 접근하고, 이 데이타베이스의 자체적인 내장 접근 통제를 사용하지 않는다면, "nobody" 사용자를 데이타베이스에 접근 가능하도록 설정해 두어야 한다. 이것은 username과 password를 몰라도 악의적인 스크립트를 사용하여 데이타베이스에 접근하고 데이타를 수정할 수 있다는 것을 의미한다. 또한 크래커가 관리자용 웹페이지를 들락거리고, 데이타베이스를 삭제해 버리는 것도 가능하다. 여러분은 아파치의 인증 기능을 사용하여 이런 공격에 대항하는 방어를 할 수 있다. 사용 When PHP is used as an Apache module it inherits Apache's user permissions (typically those of the "nobody" user). This has several impacts on security and authorization. For example, if you are using PHP to access a database, unless that database has built-in access control, you will have to make the database accessable to the "nobody" user. This means a malicious script could access and modify the databse, even without a username and password. It's entirely possible that a web spider could stumble across a database adminisitror's web page, and drop all of your databases. You can protect against this with Apache authorization, or you can design your own access model using LDAP, .htaccess files, etc. and include that code as part of your PHP scripts.
Often, once security is established to the point where the PHP user (in this case, the apache user) has very little risk, it is discovered that PHP now has been prevented from writing virus files to user directories. Or perhaps it has been prevented from accessing or changing a non-public database. It has equally been secured from writing files that it should, or entering database transactions.
A frequent security mistake made at this point is to allow apache root permissions.
Escalating the Apache user's permissions to root is extremely dangerous and may compromise the entire system, so sudo'ing, chroot'ing ,or otherwise running as root should not be considered by those who are not security professionals.