I'm relatively new to web development, so please be patient.
I'm primarily an iPhone developer, but have recently done a site for someone else using shared hosting. I could write to files in PHP on that site fine, without having to think about permissions.
I'm in the process of deploying a web service for a new app I'm making, but it's not really going smoothly. The most important difference here is I'm using someone else's server, and just have FTP/DB access.
Basically, I have a load of PHP files which make up my CMS, like so:
Those scripts then either edit the database, or files. They can interact with the DB fine, however, my scripts cannot write to the filesystem. They might, for example, attempt to write to the following files:
This worked fine on my MAMP install (locally), but once deployed to the server, PHP spewed out errors everytime a write was attempted... something like this:
Could not open file "../data/img/someimage.png" for writing.
So I emailed the guy who's running the server, and he came back saying:
Does it work with public permission? (777)
And, it did - but I was very cautious with using public permissions, so disabled it straight away again. I emailed him saying "how can I make my PHP scripts write using standard user permissions", and he said:
Leave it as public, it'll be fine
I reckon it's an ip conflict somewhere in the domain resolution, but I'm not worried about it.
I then emailed him saying "surely this is insecure" or something along those lines, and he replied with the following:
the reality is that there are millions of website, including several that I manage that have 777 on various folders, it's just a way of life.
Could anyone give me some idea of a solution I could give him? Or what I can do to avoid having to use 777? I really don't like the idea of any folders on my site/service to be publicly writeable.
I would very much appreciate your advice as I know very little about web servers.