---
title: "open_basedir restriction message"
date: "2014-11-10"
category: "php"
slug: "open_basedir-restriction-messages"
---

When a PHP script attempts to access a file, it may produce a warning like:

**Warning**: fopen(): open\_basedir restriction in effect. File(/var/www/myresource) is not within the allowed path(s):
(/home/virtual/site2/fst:/var/www/html:/usr/local:/usr/bin:/usr/sbin:/etc:/tmp:/proc:/dev:/.socket) in **/home/virtual/site2/fst/var/www/html/myfile.php** on line **3**

## Cause

PHP runs with a separate filesystem visibility for performance. File paths referenced in PHP must account for the account's pivot root, which differs from what FTP or the control panel displays.

## Solution

Prepend the _HTTP Base Prefix_ value (found in the [[logging-into-the-control-panel]] under **Account** > **Summary** > **Web**) to the file path. For example:

<?php
   // INCORRECT - will yield open\_basedir warning
   $key = file\_get\_contents("/var/www/secret.hash");
   // CORRECT
   $key = file\_get\_contents("/home/virtual/site12/fst/var/www/secret.hash");
?>

### Using the SITE\_ROOT Variable

The web server provides an environment variable called `SITE_ROOT` containing the HTTP Base Prefix value. This is the recommended approach:

<?php
   $key = file\_get\_contents($\_SERVER['SITE\_ROOT'] . "/var/www/secret.hash");
?>

Note that PHP also requires [[writing-to-files]] permissions for write access.

## See Also

- [[writing-to-files]]
