this might be a real noob question , but I couldn't find an answer.
when using regular PHP , if we execute echo `whoami`; it outputs apache. but when suPHP enabled, above code will output the user's name. I'm wondering how this helps to improve security of a website.
for shared hosting, there are multiple sites on one server.
Running as Apache / httpd you have many other people running as the same user. So User 1 can see and maybe even modify user 2's files.
When running as individual users you have much more control of who can access each file.
More important files are config ones eg database connections. Without the separation any user on that host can access any config file owner readable by apache.
Even in a non shared environment running as a user gives much more fine grained permissions. This is useful to give the user just as much access as it needs, limiting the damage if someone is able to execute commands though the web server.