I am sorry if in my documentation search I have missed the way to block this. Especially if it is just a configuration issuse.
I didnt want to post this to the php open list.

As the http server runs as the same user as php then also any file that can be read by the server  can also be accessed on the local system by a fopen 
Also seeing that the web root is also the root of the users web pages 
Any one user can do a fopen on another users suposedly hidden php source
Is it possible to stop ../ changes in the global restrictions so users cant get out of their home directories


<?
if (!($f = fopen("../other_user/secret.php","r"))){
print ("cant open that") ;
exit;
}
while(!feof($f)){
print (fgets($f,255));
}
fclose($f);
?>

Thanks Greg