Q:

How can I disallow a user's scripts from accessing anything above their user folder? 

This is probably an extremely simple question to answer for anybody who knows what they're doing, but I can't find any answers myself.   I'm trying to set up a subdirectory for my good friend to test his PHP scripts on my (Apache) hosting plan.   I don't want to let him access anything else on my server, however, for obvious reasons. 
His FTP login already leads him to the proper directory, which does not allow navigating any higher than it's root (mydomain.com/friend/).   I would like the same behavior to be applied to any scripts, so he cannot simply 
<? php print_r(glob("../*")); ? >

and view all my files.   I'm thinking this can be done with an .htaccess file setting the DocumentRoot somewhere, but I can't have the file available for modification inside the user directory. 
Is this possible without majorly rewiring the web server?   I've tried Googling all sorts of things to describe my problem, but without the proper terminology, all I get is "shared hosting" websites and people trying to sell me security packages. 

A:

You can use parameter open_basedir from PHP.  It will prevent the access of PHP script outside the directory specified in open_basedir.  Snippet from official documentation

open_basedir string
Limit the files that can be accessed by PHP to the specified directory-tree, including the file itself.  This directive is NOT affected by whether Safe Mode is turned On or Off. 
When a script tries to access the filesystem, for example using include, or fopen(), the location of the file is checked.  When the file is outside the specified directory-tree, PHP will refuse to access it.  All symbolic links are resolved, so it's not possible to avoid this restriction with a symlink.  If the file doesn't exist then the symlink couldn't be resolved and the filename is compared to (a resolved) open_basedir .