File permissions and security -

in cms, have php script opens .htm file writing - fopen('footer.htm', 'w+'). works file permissions set 666 on footer.htm, doesn't work if set 664.

am leaving file open abuse or hacking setting public permission 'write'?

i using apache virtual server.

that depends.

to modify file, attacker must able execute kind of code on server, e.g. have shell access. if case, permission smallest problem.

if on shared hosting environment (other customers don't know use webserver) these other users possibly can change file too, if provider did not setup security right , know path.

it not considered best practice set 666 permissions. of these kind of attacks happen on webserver, restriscting permission not solve problem, server needs have write access.

so can do: change mode 664 , change group of webserver running in - other users may still have write access using webserver.

what should do: ensure no malicious code written file. if find code i'm confident find persistant cross-site scripting vulnerability.