How do you permit PHP to write to a file without compromising server security

Question

I am often confronted with negative comments whenever I want to have a PHP script write output to a file on the server.

I use the fopen(), fwrite(

Answer 1

The risk is if that writable directory resides in an area accessible to the outside world. Then those with the right tools and know how can write anything they want to that directory... or file. They can then place malware in it or create a phishing scheme on your site.

Really they can do all kinds of things to compromise you. I have seen this on my own servers and haven't really found the right solution to this.