What's the best user/permission setup on Linux for a folder PHP can write to?

After years of using chmod 777 to solve PHP write permission woes, I want to know the proper way of solving the problem.

I have a website on my server owned by user1 in group user1. There is a folder in this website called uploads.

Normally to get writing with PHP to work, I have to chmod this folder to 777. But I obviously recognise this is dangerous and incorrect, and I want to setup the permissions properly to minimise risk.

From my limited knowledge, I see two options,

1. I chown the uploads folder so that it's owned by apache. This way, I can just use the default permissions and apache can happily write to the folder.
2. I add a second group to apache of user1. I then give write permission to the owner and group on uploads, which should allow apache to write to uploads?

My que开发者_如何学JAVAstion is, what is the best approach? Is it one of the above or something completely different?

If the best solution is #1, how can user1 also write to uploads over SFTP as that solution will not let them?

In my current company, we set the apache group to the group that owns the folder, so you just need to do chmod 770 on the folder to give permissions to that particular group to do funny stuff on that folder.

However you still to remember to protect your application from malicious user, as the PHP script being run, if sufficiently insecure, can still do damage to the folder.

If it's your own server, the best way is to set the folder to the group apache uses, e.g. with chgrp www-data on debian (might be different on other systems). You usually have to do this as root or at least as a user who has access to his own and www-data group. If your user has access to www-data group, this might be a cool feature for you since its easy then to read and maybe write/move the files. In this case, use 770 as the file permission and ensure that files created by php get this permission (either explicitly after creating with chmod or with umask before creation. See php manual for both.)

If you are working on a shared hosting environment, the only clean solution I know is mod_suexec, but I don't know many hosters that enable it. If this is not available I know only the way you do know, working with 777. Often, your home directory in shared environments have a longer random string in the path name so that others should not find your directory and therefore can't access your files. But this is not real security.. ;-)

Good luck Michel