Ideally, a user just dedicated to PHP (with locked down permissions). Also have a look at upload_tmp_dir (you may want to change this as well, although it is not necessary).

Sorry for reviving this old thread but how can I know if my site is compromised?

usually if you keep your bulletin board up to date, your pretty safe

You don't really know until its too late. However, as mentioned above, keeping your software as up to day as possible will reduce this risk.

What about the tmp folder?

What about it? As long as you keep PHP's temp directory secured, you should be fine.

What I meant was how do I know if the /tmp/ folder is not secured?

The hacker does not use a /tmp dir, to hack your forum. He takes advantage of your 0777 chmoded dirs in vB to screw you nice.
I posted this issue long time ago but people thought I'm crazy. I even wrote a tutorial on this site how to secure vB... Put it this way: You have a 0777 dir into your /var/www/html (or whatever is the web root)? You can be hacked, very easy.

Read this article I wrote long time ago... probably nobody read it.
Then secure the same way the curent 0777 dirs, not just the config file. Chmod them to 0750 and own them by nologinuser:root.

Thank you!

Teck-

Just to make sure I understand, moving the config.php to another directory out of the public html will not affect vb operation?

I was just hacked yesterday and confirmed that it was some sort of database insertion, based on that when I restored a backup database, the hack was cleared. I wasn't able to find any files with changed dates.

Is there some other way, other that the hacker breaking the config.php that they could manipulate the database?

Note that I also have htaccess on all pertinent directories.

Thanks!