Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone explain me the difference between include_path and open_basedir in PHP? My php.ini looks like this:

include_path = ".:/usr/share/php:/usr/share/pear:/var/www"

If for example I try using include('../../etc/passwd'); the file will be included. On the other hand, when I'm modifying my php.ini like this the output is empty:

open_basedir = /var/www

Why is this? I thought that using include_path will restrict the file access to the directories listed there?

share|improve this question
up vote 0 down vote accepted

The include_path directive is a list of directories to look for included files first, similar to bash's $PATH environmental variable.

So an absolute file name/path like this:


Can be replaced with a relative filename like this:


This is at least how I understand it. It has nothing to do with security and restricting directories, it is to create a custom search path for common includes.

open_basedir is what you are looking for, it limits the reading of files to the directories specified. Based on your question, it looks as though it is operating as designed.

share|improve this answer
Thank you! Got the point now. – Jason Sep 14 '13 at 9:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.