Essentially i found out you can limit the folders each user has access to by using php's basedir/open_basedir.

I'd like to have each php only access its own files. So i wrote

fastcgi_param  open_basedir       $document_root;

in hopes that it would work. It didnt. I googled and only found results saying you cant do it via fastcgi or nginx.

Is this true or can i not do it?

PS: I -do- spawn php as its own user (rather then www-data) so it doesnt wreak havoc on my nonphp websites. But i still like to prevent one php script on a php site from accessing other directories (if i have a wordpress install on yourface.com its pretty obvious a valid php path is /var/www/yourface/<wordpress scripts>