Can suPHP lead to security issues due to hijacking people's accounts?

Question

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on suPHP. I am assuming you use it exactly like PHP and it magically knows to run all scripts as the owner of that script.

I am creating a dynamic website which lets users upload scripts and execute them. Right now this is limited to javascript but I want to also allow them to execute serverside PHP scripts. As the default Apache user is www-data, I want to use suPHP. My idea is to create an intermediate script, lets call it load.php, which takes as an argument the user's target script, lets call it target.php. load.php then checks to see if the user owns target.php, and if they do, launches target.php.

But then what's to stop the user from within target.php issuing a command like (I am not sure if this example is accurate as I can't find any documentation on suPHP).

shell_exec("suphp /home/someOtherUser/test.php");

Does suPHP need a user's password to execute these scripts?

---

Janne Pikkarainen pointed out that suPHP starts as root, then switches to the owner of a file before executing it. So now I have two questions.

1. If the PHP script that's executed by suPHP (as the owner, lets call him user1) in turn contains shell_exec("php /home/user2/test.php");, will this return an error since user1 is trying to launch user2's script, or will suPHP kick in again and change from user1 to user2.
2. what's to stop user1 from executing javascript/HTML code such as <form action="/home/user2/test.php" method="get">?

Answer 1

(In Darth Vader's voice): NOOOOOOOOOOOOOOOOOOOOOOO

That's not the way you use or configure suPHP. Even if you somehow manage to get it run that way, it is more dangerous than useful.

suPHP is supposed to be configured at Apache (or whatever your webserver is) level. The idea is to make Apache run suPHP instead of regular mod_php.

How suPHP actually figures out under what account to run the script as is not magic; it simply sees that from the file owner. At beginning suPHP runs as root, and before running the script it just changes the user to be the one owning the file, dropping the root privileges.

EDIT after your own edit: No. Let me explain this one more time. You cannot and should not even attempt to run suPHP via PHP's shell_exec. That's not its idea. Not at all.

suPHP belongs to Apache configuration file httpd.conf, not in individual PHP scripts. There is no exception about that.

Here's suPHP configuration documentation for you.