From hazy memory there were two ways of configuring apache/mod_php. 1) The web server ran with a common account (eg www-data), and only had read access to user

From hazy memory there were two ways of configuring apache/mod_php. 1) The web server ran with a common account (eg www-data), and only had read access to users files. 2) The web server could be configured to run each site in the context of the file owners. The advantages of 1) were that your website didn't have write access to your files. The advantages of 2) were that other peoples websites didn't have read access to your files, but your own site could overwrite them. I only felt "safe"(ish) on a dedicated server, using option 1).