There is a better solution than starting every virtual host in a seperate instance, which is wasting ressources.
You can set open_basedir dynamically for every virtual host you have, so every PHP script on a virtual host is jailed to its document root.
Example:
<VirtualHost www.example.com>
ServerName www.example.com
DocumentRoot /www-home/example.com
[...]
<Location />
php_admin_value open_basedir \ "/www-home/example.com/:/usr/lib/php/"
</Location>
</VirtualHost>
If you set safe_mode on, then the script can only use binaries in given directories (make a special dir only with the binaries your customers may use).
Now no user of a virtual host can read/write/modify the data of another user on your machine.
Windseeker
