Quote: "But he showed me this php script he uploaded it and it could see every file on my hard drive"
Well... what did you expect? If you don't want that script to see all your files - don't have it stored on the server! It's quite simple really...
If a hacker is at the stage where they can upload files to your server, then it's too late - there's no amount of MySQL/Apache/FileSystem based security that will prevent someone from trashing your server if they guess your FTP password :S
There are two kinds of security you need to implement. chroot jails and general file permissions. the chroot jail will stop me uploading files to directories outside my designated area.
File permissions will get you half way to what you want to achieve - i.e. stopping someone reading /home/alex from their web application.
I can read files outside of my public_html directory. Like the /etc/ directory and such. However, I cannot read someone else's home or public_html directory because the host has spent a lot of time permissioning the whole system correctly.
The answer does not lie in restricting what scripts can do, it's configuring your file permissions, users and groups properly.
Something tells me you're trying to run before you can walk...
[center]
game dev ... is like a bouncy castle full of breasts - VanB
